CareCloud has disclosed a breach of its talkEHR platform with at least 45,000 patient health records confirmed at risk and the potential scope reaching millions. The attack vector has not been publicly disclosed. Organizations using talkEHR must confirm whether their patient population is within scope, assess HIPAA breach notification obligations with their compliance and legal teams, and rotate talkEHR administrative credentials pending CareCloud’s full disclosure. Worth noting this touches HIPAA regulatory obligations and potential OCR notification requirements — verify breach notification timelines and scope with your compliance counsel and privacy officer.