The letter went on to inform me that they're a vendor to Sutter Health and they were impacted by the MOVEit breach. In summary, the letter was to notify me that my personal data including treatment information and diagnosis were potentially affected. To say I was surprised was an understatement given that Sutter Health hadn't notified me about this incident. And this incident seemed to have occurred between May and July.
I Googled this and found a discussion about this on Reddit [1] and just like me a lot of people were surprised because Sutter hadn't notified them, the letter they got didn't mention Sutter prominently (even on the envelope) and people initially thought it was spam. Further Googling showed that Sutter posted a notice on their site on Nov 3 [2].
I find it extremely surprising that Sutter Health didn't notify patients directly. How would people have seen the notice given that most people go to a Health Provider's website ONLY when they have a medical issue. The notice from Welltok also seems to minimize the potential impacts of the breached data. Welltok is offering free credit monitoring for 12 months. What about personal medical records that have been breached (diagnosis, treatment, date of birth, etc)? Even the credit monitoring requires a sign-up with a credit card. Why couldn't they have reached a deal with the credit agencies to allow for a signup without a card?
Welltok or Sutter Health also don't say how many years of your personal/medical record was affected.
1. https://www.reddit.com/r/bayarea/comments/17q10j6/psa_patien...
2. https://vitals.sutterhealth.org/sutter-health-vendor-reports...
I'm pretty sure that kind of data usually stays forever. Best case, they delete it after 5 or 7 years but if that process isn't automated it won't happen.