Why are 1.8M Apria patients just now being notified of a 2021 data breach?

HIPAA requires entities to disclose breaches within 60 days, but it took 18 months for Apria Healthcare to inform over 1.8 million patients.

Article Link: Why are 1.8M Apria patients just now being notified of a 2021 data breach? | SC Media