The practical consequence for individuals: you can get a breach letter from a company you have never heard of. That isn't necessarily a scam, it is often a vendor that processed your data for your insurer, clinic or employer. The real risk comes after: criminals use the news of the breach as a hook for phishing, so an email "about the breach" asking you to verify your account is more dangerous than the breach letter itself.
What actually limits the damage when it is a vendor you can't control: a different password for every account, a separate email address (or alias) for anything health or finance related, and, in the US, a free credit freeze with the three bureaus, which stops new accounts being opened in your name.
https://www.hipaajournal.com/vendor-data-breaches-69-breach-victims/
Read the thread: https://briskness-byte.github.io/thread/?url=https%3A%2F%2Fwww.hipaajournal.com%2Fvendor-data-breaches-69-breach-victims%2F
