I was reading a press release from a large health care provider notifying customers of a potential data breach. According to the company, “a test database was inadvertently left accessible via the Internet.” Upon learning of the incident, the company secured the database and removed it from public view. It then conducted an “exhaustive investigation,” determining that the database included patients’ names, addresses, telephone numbers, email addresses, medications, and “limited” clinical information.