Texas medical group under fire for waiting 7 months to notify patients they paid hackers after attack