Can Anyone Find Your Breach Notice? We Checked 16 Dental Incidents

Breach response can feel finished the day the letters go in the mail.

That leaves out the page patients and search engines go looking for next. We checked the public notices from 16 well-known dental breaches and incidents to see whether that page can be found. Of the six notices still online, two appeared in the top 20 Google results for their own incident. Where a data breach notice is indexed, Google’s AI Overview can repeat the practice’s own account. For DentaQuest and Hawaii Family Dental, whose notices carried noindex tags, the AI Overviews cited third parties, and Hawaii’s repeated the ransomware group’s claim of roughly 20 GB stolen.

For a DSO, the problem has one more layer. Patients know the name on the door of their own office. If the notice lives only on the corporate site, a patient searching for that practice name may never reach it.

What we checked, and how

We started with the 13 incidents on our dental data breach roundup and added eAssist, Hawaii Family Dental and Community Dental Care. For Park Dental we looked only at its 2024 incident. For each organization, we looked for a public notice through its home page, archived copies of its site, and links from state filings or news reports. We never guessed a web address. We found notices from 11 organizations on their own sites (Park Dental’s two PDFs count as one) and one hosted by a breach-response vendor.

Then we read the page source and checked for two kinds of search restriction. A noindex tag in the page, which Google says will make it “drop that page entirely from Google Search results,” or a rule in the site’s robots.txt file that stops search engines from reading the page at all. Last, we searched Google on October 2, 2026 for each live notice, using the organization’s name plus breach terms or the notice’s own wording, and checked the top 20 results.

Old notices coming down is normal, and this audit did not establish how long each one stayed up. The table marks those as taken down and judges them only on how they were set up while live.

The audit: 16 dental breaches and incidents

“In Google” records whether the notice appeared in the top 20 Google results on October 2, 2026, for searches on the organization’s name with breach terms or the notice’s own wording. A result that showed up only in a search limited to the organization’s own site is marked separately. Page source read October 2, 2026, or from archived copies for notices since taken down.

Organization	Own public notice	Open to search engines	In Google	Linked from home page while current
MMG Fusion	None found	n/a	n/a	n/a
DentaQuest	Yes, web page	No (noindex tag)	No	Yes
MCNA Dental	Page hosted by a breach-response vendor	Not checked	Expired	Yes
Delta Dental of California	Yes, PDF	No (robots.txt)	Only in a site search	Yes
Great Expressions Dental Centers	Yes, web page	Yes	Taken down	Yes
Dental Care Alliance	None found	n/a	n/a	n/a
Absolute Dental	Yes, web page	Yes	Taken down	Yes
Risas Dental & Braces	Yes, web page	Yes	Yes	Yes
Park Dental and The Dental Specialists	Yes, two PDFs	Yes	No	Yes
First Choice Dental	Yes, web page	Yes	Taken down	Yes
Chord Specialty Dental Partners	Yes, web page	No (noindex tag)	Taken down	Yes
Professional Dental Alliance	None found on the group’s site	n/a	n/a	n/a
Henry Schein	Yes, corporate press release	Yes	Yes	Yes, via investor page
eAssist	None found as of October 2, 2026	n/a	n/a	n/a
Hawaii Family Dental	Yes, web page	No (noindex tag)	No	Yes
Community Dental Care	Yes, web page	Yes	Taken down	Yes

What the table shows

Every notice we found was linked from the home page

All 11 notices on an organization’s own site were linked from its home page while the notice was current, usually through a banner or a header link. Henry Schein’s banner went to its investor page, which listed the incident updates. When insufficient or out-of-date contact information keeps a practice from sending written notice to 10 or more affected patients, 45 CFR 164.404(d)(2) requires substitute notice: “a conspicuous posting for a period of 90 days on the home page of the Web site of the covered entity involved, or conspicuous notice in major print or broadcast media in geographic areas where the individuals affected by the breach likely reside,” with a toll-free number that stays active for at least 90 days.

HHS added a useful detail when it issued the rule. A practice “may provide a hyperlink to the notice,” and that link “should be prominent so that it is noticeable given its size, color, and graphic treatment in relation to other parts of the page,” according to the 2009 interim final rule. Nothing in the regulation mentions search engines. So a noindex tag is a question of whether the notice does its job. It is not, by itself, a HIPAA violation, and I would not describe it that way.

Four of the 11 restricted search engines

Here is what the page source, live or archived, and the sites’ robots.txt files showed on October 2, 2026:

• DentaQuest. Its notice of data breach carries noindex, nofollow. DentaQuest’s home page carries no such tag.
• Hawaii Family Dental. Its notice of data security incident carries noindex, nofollow, while its home and contact pages are set to index, follow and link to the notice in a banner.
• Chord Specialty Dental Partners. Archived copies of its notice from March and May 2025 carry noindex, nofollow, while the home page at the time was set to index, follow and linked to the notice. The page has since been taken down.
• Delta Dental of California. Its MOVEit notice is a PDF in a folder that the site’s robots.txt file blocks, under a rule that covers every PDF in that folder. Google notes that a blocked page “can still be indexed if linked to from other sites.” On October 2, the PDF showed up for a site search of deltadentalins.com and not for searches on the incident.

A tag in the page source is a fact about a page. It tells you nothing about why it is there. Website platforms apply these settings through templates, plugins and page-level checkboxes. TechCrunch reported in January 2025 that Change Healthcare’s breach notice carried a noindex tag for months.

Open to search engines is the floor

Risas Dental & Braces’ notice ranked first for “risas dental data breach,” and Google’s AI Overview cited it as a source and repeated its statement that Social Security numbers were not involved. Henry Schein’s own October 2023 statement ranked second for “henry schein cyber incident update.”

The Park Dental and The Dental Specialists notices show the other side. Both are PDFs that search engines are allowed to read, and neither appeared in the top 20 for the searches we ran. Neither is linked from its home page anymore, and on October 2 newer coverage filled those results. Allowing crawling helps Google read a notice’s content. It does not guarantee a result, and this audit did not establish why those two PDFs were missing.

Two AI Overviews built without the organization’s own notice

On October 2, the AI Overview for the Hawaii Family Dental breach cited the federal breach portal, a law firm page, a class action site, dental trade publications and an Instagram post. It did not cite the practice. It repeated the ransomware group’s claim of roughly 20 GB of stolen data alongside the facts. The DentaQuest Overview drew on Have I Been Pwned, a class action site and security news coverage. Those sources may be accurate. The organization’s own notice was missing from the summary.

In September, Google’s AI Overview still called the Hawaii Family Dental breach unconfirmed, a gap we covered in our Hawaii Family Dental breach analysis.

Four organizations where we found no public notice

MMG Fusion was a business associate, so its notice duty ran to the dental practices it served. In its March 2026 settlement announcement, the HHS Office for Civil Rights said MMG had potentially violated HIPAA by “failing to notify covered entities affected by the incident of the breach.” For Dental Care Alliance and Professional Dental Alliance, archived copies of their sites are thin, and we could not confirm a notice either way. At least one practice affiliated with Professional Dental Alliance posted its own. We found no public notice on eAssist’s website as of October 2, 2026. eAssist told customers on September 8 that it was investigating a potential incident, according to the Georgia Dental Association, and later sent former customers a follow-up security notice. Our eAssist data breach coverage tracks what has been confirmed since.

MCNA sits in between. Its notice ran on a page hosted by a breach-response vendor and linked from MCNA’s home page, and that page has since expired.

Should a breach notice page be set to noindex?

If the goal is for patients to find your account, leave the notice indexable. Once Google crawls a notice and processes its noindex tag, it removes the page from Search. Google’s documentation says a page must be “indexed and eligible to be shown in Google Search with a snippet” to appear as a supporting link in an AI Overview. The tag has no effect on what law firms, breach trackers and news sites publish about the same incident. In this audit, the two live notices carrying noindex did not appear in the top 20 for their own incident, and the AI Overviews for those incidents cited other sources. This is a decision for the practice and its counsel.

Breach response has a public-record half

Containment, forensics, the notification clock and the letters are the work everyone expects after a breach. Our guide to what HIPAA breach notification requires covers those clocks.

The public-record half is the version of events people find when they search. In the breaches we track, plaintiff firm pages and breach trackers often go up before the organization’s own notice does. Your notice may arrive later, and it is the account you approved.

Counsel decides when a public posting is required. Whether that page appears in search is a separate decision. Make it on purpose, because website templates and plugins can set it for you. Then have your IT partner confirm the live page matches what you decided.

A findability checklist to hand your IT partner

1. Publish it as a web page on your own domain. A PDF can rank, but a plain web page is easier to read on a phone. If a breach-response vendor hosts it, link to it from a page you control, because vendor pages can expire.
2. Read the page source before and after it goes live. Confirm the robots settings match what you decided. Search the source for “robots” and check the response headers for an X-Robots-Tag.
3. Check robots.txt against the page’s address. A rule that blocks a whole folder also blocks any notice saved in it. That is how the Delta Dental PDF was set up when we checked on October 2.
4. Link it prominently from the home page. The 2009 HHS guidance describes a link that stands out by size, color and graphic treatment. For a DSO, link it from every practice site patients actually use.
5. Title it the way a patient would search. “[Practice name] Notice of Data Security Incident” is plain and matches how people look for it.
6. If you want it in search, add it to your sitemap and request indexing. Google Search Console’s URL Inspection tool can request indexing for a single page.
7. Search for it after a week or two. Use the practice name plus “data breach,” the way a patient would, and check what the AI Overview cites.
8. Plan the takedown. If the posting is your substitute notice, keep it up and keep the toll-free number active for at least 90 days. When it comes down, decide where that address should point.

If something has already happened, start with our guide to what to do in the first hours after a breach. Put the notice page on the same list as the forensics firm and the letters.

Posted in Dental Cybersecurity, Research