A reported victim post tied to a healthcare documentation provider is less proof of breach than a reminder that extortion crews prize organizations close to sensitive records and recovery pressure.