We're a few years into the medical-specific breaches. I've had my medical record stolen from an ex-employer's health insurer (4 years after I was no longer employed with them but who knows how long they hold it since most cybersecurity practices arent followed let alone data deletion laws) as well as my state DMV.