Multiple providers may have had sensitive patient data stolen after a data breach at a law firm that serves many providers.