Employees of a customer of a processor. Three steps from the incident, with no point at which they could have exercised judgement.
A patient chooses a practice. The practice chooses the software. The patient has no relationship with the supplier and cannot change it.
No data involved, no system touched, no notification anywhere. The company simply could not trade.
Hospitals reorder against expected supply. A delay of weeks means deferred procedures nobody will ever connect to a supplier’s IT incident.