Your Pharmacy's Website Can Leak Patient Data, Too

A pharmacy in Montana recently learned something I want every independent pharmacist I work with to hear. The trouble did not start with a dispensing error, a break-in at the store, or a compromised computer in the pharmacy itself. It started with the website.

Ridgeway Pharmacy, a mail order and community pharmacy in Victor, Montana, reported a breach of its website, which a third party vendor built. According to its notice, the pharmacy found problems with the website on July 23, 2026, and a vulnerability allowed an unknown third party to get into the website. Names, addresses, birth dates, prescription and health and insurance information, and some payment card information may have been exposed. HIPAA Journal's report says 258,920 of its customers were affected, and that the incident was limited to the website, with no internal systems involved.

Let me be clear about something before anything else. I am not criticizing Ridgeway Pharmacy. Nothing in the public reports suggests they did anything careless. This could happen to any pharmacy with an online refill form or an online store, which today means nearly every pharmacy I know. A website built and hosted by a vendor is still a doorway to patient information, and whoever built the doorway does not carry the responsibility alone.

I wrote this walkthrough for dentists about how dental practices handle cloud software risk, and the same thinking applies behind the pharmacy counter. Here is how I would talk it through with you.

Your website is part of your pharmacy now

There was a time when a pharmacy website was a digital business card. Hours, directions, maybe a phone number. Those days are gone.

Today your website probably takes refill requests. It may run a patient portal. It may host an online store where customers order prescriptions, over the counter products, or pet medications. It has contact forms where people describe symptoms or ask questions about their medications. Every one of those features collects patient information.

And here is the part that matters for this story. A lot of that information does not live on a computer in your store. It lives on a platform your vendor built and runs. When a customer types their date of birth into your refill form, that data passes through systems you do not own. From the patient's point of view, it is still your pharmacy that lost their information.

Questions to ask your website vendor

I am not suggesting you fire your web vendor. Most of them are good people running a hard business. I am suggesting you ask them a few direct questions, because most pharmacy owners never have.

First, who maintains security and updates? Software has to be patched, plugins updated, and problems fixed on a schedule. If nobody owns that job, it quietly does not get done.

Second, who is notified first if something goes wrong? If your vendor discovers suspicious activity on your site at two in the afternoon, do you hear about it that afternoon, or next week? The clock on breach response starts early, and the answer to this question matters.

Third, what does the contract say about responsibility for a breach? Many vendor agreements say the vendor is not responsible, or responsible only in narrow cases. Your attorney can help you understand what you actually signed.

Fourth, does the vendor carry its own cyber insurance? Ask for a certificate. If they do not carry any, that tells you something about how a breach on their side would play out for you.

What cyber insurance should cover

A data breach sets off a chain of costs, and a well built cyber policy is designed to meet them. As you review your own coverage, here is the list I would walk through.

Notification costs. Depending on the situation, you may need to notify every affected person, and that means letters, printing, and mailing at real scale.

Credit monitoring. Offers of credit monitoring for affected customers are a common and often expected part of making people whole.

Forensic investigation. Figuring out what happened, what was accessed, and how to close the door is specialized work, and it is not cheap.

Legal defense and regulatory proceedings. A breach involving health information draws attention from regulators, and defending that attention takes lawyers.

And one question pharmacists rarely think to ask: does the policy cover a breach that starts on a vendor's system? Ridgeway's incident, based on public reporting, appears to have started exactly there. Not every policy answers yes. Some policies treat a vendor's system differently than your own. Read your policy wording and check your limits, or better, have your agent read it with you line by line.

Your other policies probably don't

Here is a conversation I have had many times. A pharmacist assumes their general liability policy or their professional liability policy would handle a data breach. Neither is usually built for it.

General liability is built for bodily injury and property damage, the slip in the parking lot and the fender bender with the delivery truck. Pharmacy professional liability is built for the practice of pharmacy, the dispensing and the counseling. A stranger stealing patient data through a website vulnerability fits neither policy naturally, and a claim filed under the wrong policy is a claim that gets delayed while everyone argues about whether it applies at all.

The good news is that this is an easy question to answer in advance. Ask your agent to look at your current policies and tell you plainly whether a website breach would be covered. Our pharmacy insurance guide walks through the full lineup of coverage a pharmacy should carry, cyber included.

The takeaway

Ridgeway Pharmacy's story is a hard reminder that the perimeter of a pharmacy is bigger than the building. It includes the refill form, the online store, and every vendor system those touch. The best time to understand how your coverage responds is before a breach, not after.

If you would like a second set of eyes on your cyber coverage, or you are not sure whether your website's vendor arrangement is reflected anywhere in your insurance at all, reach out through my contact page and I would be glad to review it with you.

This article is for general informational purposes only. It is not legal, tax, or insurance coverage advice, and it does not describe any specific policy. Requirements vary by state, carrier, and contract. Check with your agent and attorney regarding your specific circumstances.