If a breach hit tomorrow, could you prove your practice was ready?

Medical spas hold clinical records and patient photos while marketing like a retail brand, and texting a client's before-and-after image or posting it without documented authorization is the kind of disclosure OCR treats as a reportable breach.