TL;DR

The week of July 21–27, 2026 was rough for healthcare data. Reporting from that period includes a compromise at Craneware, a Scotland-based healthtech firm serving over 2,000 US hospitals and close to 10,000 clinics and pharmacies; Abbott Laboratories appearing on ShinyHunters' leak site after a voice-phishing campaign against employees the prior month; and a breach at MCBS affecting roughly 1.2 million individuals.

You are not going to prevent any of that. What you can control is whether you still have a copy of your own records when a portal goes into maintenance mode, a vendor relationship ends, or a provider migrates systems in the aftermath.

The practical move: save the pages you'd struggle to reconstruct. Visit summaries, medication lists, insurance explanations of benefits, prior-authorization approvals, billing statements, and secure-message threads with your care team. Convert: Web to PDF converts those pages locally, in your already-logged-in browser session, without sending a single byte anywhere. That last part is not a marketing line — it's the entire reason a local extension is the right tool for a patient portal, and an upload-based converter is the wrong one.

One honest caveat up front, and it runs through this whole post: where your provider or insurer offers an official PDF or a formal records request, use that. An official record is the authoritative document. What you make yourself is a personal working copy — genuinely useful, not a substitute for the official one.

Why breach news is the wrong moment to discover you have no copies

The direct harm from a breach is disclosure — someone has data they shouldn't. That's the part that gets covered.

The indirect harm is access disruption, and it's the part patients actually experience:

  • Portals go read-only or offline during incident response. Sometimes for days.
  • Vendor contracts get terminated. When a hospital drops a compromised vendor, the patient-facing tooling that vendor powered goes with it. Historical data may or may not migrate cleanly.
  • Forced credential resets lock out people who used an email address they no longer control.
  • System migrations accelerate. A breach is often the push that moves a provider to a new platform, and migrations lose things — attachments, message threads, older visits.
  • Records retention windows quietly apply. Portals often show a rolling window of history rather than everything, and nobody tells you when something falls off the back.

None of that is malicious. It's just what happens operationally after an incident. And in every one of those scenarios, the person who saved a PDF in July is fine and the person who assumed the portal would always be there is filing a records request and waiting.

What to save, in priority order

Not everything. A pile of 200 PDFs you never organized is barely better than nothing. Work down this list and stop when you hit the boundary of what you'd actually need.

Tier 1 — save these today

  1. Active medication list. The single most useful document to have offline. If you end up in an urgent-care setting, this is what you're asked for.
  2. Allergy and adverse-reaction list. Same reason.
  3. Recent visit summaries — say the last two years. These contain assessments and plans you cannot reconstruct from memory.
  4. Current prior-authorization approvals. These have expiry dates and reference numbers, and losing one mid-treatment is genuinely disruptive.
  5. Active referrals with their reference numbers and validity windows.

Tier 2 — save these this month

  1. Lab and imaging results you've discussed with a clinician, plus the report text (not just the value).
  2. Explanations of Benefits from your insurer for anything still in dispute or within an appeal window.
  3. Secure-message threads where a clinician gave you instructions. These are frequently the only written record of "take this for six weeks, then call me."
  4. Immunization records, particularly if you need them for travel, school, or employment.
  5. Billing statements for anything unresolved.

Tier 3 — nice to have

  1. Care-plan documents and patient-education material specific to you.
  2. Appointment history, if you're tracking a chronic condition timeline.
  3. Provider directory pages for specialists you see, in case network status changes.

Where to get the official document instead

This matters and it's where a lot of well-meaning advice goes wrong. Several of the things above have an authoritative version available, and you should take the authoritative version when it exists:

  • Formal medical records requests. Under HIPAA, you have a right of access to your designated record set, typically fulfilled within 30 days. That's the document that carries weight with a new provider, a disability determination, or a legal matter. A PDF you printed from a portal page is not that.
  • Insurer-issued EOBs. Most insurers offer a downloadable PDF of the actual Explanation of Benefits. Download that file rather than converting the summary web page.
  • Immunization registries. Many US states run an immunization information system that issues an official certificate. For school or travel requirements, that's what's accepted.
  • Lab-issued reports. Labs frequently provide a signed PDF of the report itself. Take that over the portal's rendered summary view.
  • Itemized bills. Ask for the itemized statement as a PDF; it's a different, more complete document than the balance summary on screen.

So what's a self-made PDF actually for? Three things, and they're real:

  • Speed. You have it now, not in 30 days.
  • Coverage of the gaps. Secure-message threads, portal-only care plans, appointment histories, and dashboard views often have no official PDF equivalent at all.
  • Proof of what you were shown. If a portal displayed a prior-auth as approved on a given date and later shows otherwise, your dated capture is the record of the discrepancy.

Use both. Request the official records for the authoritative set; capture the portal for everything else and for immediacy.

Why local conversion is non-negotiable here

Patient portals are behind a login, and the content is about as sensitive as personal data gets.

A URL-based converter — PDFCrowd, Adobe's online webpage-to-PDF, and every "paste a link, get a PDF" service — works by fetching the URL from their server. Their server isn't logged into your portal. It gets a login page. So beyond the privacy problem, these tools simply do not work for this task.

An upload-based converter has the opposite problem: it works, but only because you handed it the document. Now your medication list is on a third party's infrastructure, subject to their retention policy, their breach exposure, and their subprocessors. Given that the whole premise of this post is a week of vendor breaches, adding another vendor to the chain is a strange response. We've written about the general case in are online PDF converters safe in 2026 and why a PDF converter shouldn't upload your files.

Convert: Web to PDF runs entirely in your browser. It uses Chrome's own print engine via the DevTools Protocol, reading the page your authenticated session already rendered. There is no server leg. Nothing to intercept, nothing to retain, nothing to breach. You can verify this yourself: open DevTools, go to the Network tab, and run a conversion. You'll see the page's own requests and nothing from the extension.

The mechanics for portal pages specifically

Patient portals are, almost universally, JavaScript applications with lazy-loaded panels. A few things make the difference between a complete capture and a frustrating one.

Expand everything first. Visit summaries collapse sections by default — assessment, plan, vitals, notes. Medication lists paginate. Message threads show the most recent and hide the rest behind "show earlier." Click every expander before you convert. The extension captures what's rendered; a collapsed panel isn't rendered.

Use Load All Images if the page includes scanned documents, charts, or imaging thumbnails. Portals defer these aggressively.

Stay in default mode for structured pages. Article Mode's Readability pass is designed to isolate a prose article. A lab result page is a table, a header block, and reference ranges — Readability will pick one region and drop the rest. Use default mode and clean up with Remove Elements.

Use Article Mode only for prose. Discharge instructions and patient-education pages are actual articles and Article Mode handles them beautifully.

Capture Element for a single table. If you only need the medication table, Capture Element grabs it with the text still selectable, which a cropped screenshot doesn't give you.

Check the date. Portal pages often show a "last updated" or "as of" stamp. Make sure it's inside your capture region. A medication list with no date on it is much less useful a year later.

Set your paper size before batch-capturing. Wide tables — billing histories, lab panels with many columns — fit far better on A3 or Ledger in landscape than on A4 portrait. This is the fix for the classic "the right-hand columns got cut off" problem, covered in fitting a wide table on one PDF page.

Organizing what you save

A naming convention takes two minutes to adopt and saves an hour later:

2026-07-28_visit-summary_dr-nguyen_cardiology.pdf
2026-07-28_medications_active-list.pdf
2026-07-28_eob_bcbs_claim-4471203.pdf

Date first, document type second, identifying detail third. Keep them in one folder per year, backed up somewhere that isn't the same laptop.

If you manage care for a parent or a child, one folder per person, and put the person's name in the path rather than in every filename.

What this doesn't do

Being straight about the limits:

  • It doesn't make a legally authoritative record. For anything with legal or benefits consequences, request the official records.
  • It doesn't do OCR. If the portal shows you a scanned document as an image, your PDF contains that image. The text in it is not searchable, because the extension doesn't run optical character recognition — it preserves the text layer that already exists in the page, which for a scanned image is nothing.
  • It doesn't bypass anything. If a page requires a login you don't have, or a document requires a request you haven't made, no extension changes that.
  • It doesn't protect data already taken. Archiving is about your continued access, not about the breach itself. For the breach, the relevant steps are the standard ones: monitor the notification you receive, take the credit monitoring if offered, freeze your credit if you're concerned, and be alert to targeted phishing that references real details about your care.

That last point deserves emphasis given the Abbott incident reportedly began with voice phishing against employees. Breached healthcare data makes very convincing pretexts. Treat unexpected calls referencing your specific care as suspicious by default, and call back on a number you looked up yourself.

Frequently asked questions

Which healthcare breaches happened in late July 2026?

Reporting covering July 21–27, 2026 includes a compromise at Craneware, a healthtech vendor serving over 2,000 US hospitals and nearly 10,000 clinics and pharmacies; Abbott Laboratories being listed on ShinyHunters' leak site following a voice-phishing campaign against employees the previous month; and a breach at MCBS affecting approximately 1.2 million individuals.

Should I save portal pages as PDF or request my official records?

Both, for different reasons. Request official records for anything with legal, insurance, or continuity-of-care weight — that's the authoritative document, and under HIPAA you have a right of access typically fulfilled within 30 days. Save PDFs for immediacy and for the many portal-only artifacts, like secure-message threads and care plans, that have no official equivalent.

Is it safe to convert a patient portal page to PDF?

With a local extension, yes — the page never leaves your browser, because conversion runs through Chrome's own print engine on your machine. With an upload-based or URL-based online converter, no: the first puts your health data on a third party's servers, and the second can't even see a logged-in page, so it fails anyway.

Why doesn't a URL-based PDF converter work on my patient portal?

Because it fetches the URL from its own server, which isn't logged into your account. It receives the login page, not your records. Only a tool running inside your authenticated browser session can see what you see.

Can the extension make scanned documents in my portal searchable?

No. It has no OCR. If the portal displays a scanned document as an image, the PDF will contain that image and the text inside it won't be selectable. Where the portal renders real text, that text stays selectable and searchable in the output.

What should I save first if I only have ten minutes?

Active medication list, allergy list, current prior-authorization approvals, and the last two years of visit summaries. Those are the documents that matter most in an urgent situation and the hardest to reconstruct from memory.

How do I capture a lab result page without losing the reference ranges?

Use default mode rather than Article Mode. Lab pages are tables with header blocks and reference-range columns; Readability's article-isolation will typically keep one region and discard the others. If the table is wide, switch to A3 or Ledger in landscape so the right-hand columns aren't cut off.

Does saving my records help with the breach itself?

No — archiving is about maintaining your own access when portals go offline, vendors are dropped, or systems migrate. For the breach, follow the notification you receive, consider credit monitoring and a credit freeze, and be especially skeptical of calls or emails that reference real details of your care.

Bottom line

Three healthcare breaches in one week is a pattern, not an anomaly, and the aftermath reliably includes portal disruption, vendor changes, and migrations that lose data. The patients who come through that smoothly are the ones who already have copies.

Request your official records for the authoritative set. Then spend fifteen minutes capturing the portal-only material — medication list, visit summaries, prior auths, message threads — as PDFs on your own machine, with a filename convention you'll still understand next year.

Convert: Web to PDF is free, has no account, and makes zero network requests during conversion. It works on logged-in portal pages precisely because it never leaves your browser — which, in a month like this one, is the only property that matters.

For lighter reading afterwards: CineMan AI shows IMDb and Rotten Tomatoes ratings inline on Netflix, Prime Video, and Disney+. Free, no account, no data collection.