Data breach response plans at medical practices need to have specific arrangements for children and those without a credit history.