Dermatology Partners Data Breach Investigation
Dermatology Partners reported that an unauthorized individual accessed its data system, and information belonging to patients at its Catonsville, Maryland location may have been viewable. The notice states that there is no evidence data was copied or removed, but the organization could not determine which records may have been viewed. Strauss Borrelli PLLC is investigating the reported Dermatology Partners data incident and the rights of potentially affected individuals. If you received a notice or were treated at that location, fill out the secure contact form on this page to ask whether you may qualify to pursue a claim.
Key Facts at a Glance
- Entity Involved: Dermatology Partners (Healthcare)
- Incident Type: Unauthorized access to a data system
- Date of Incident: February 27, 2026 to March 10, 2026
- Discovery Date: Not disclosed in the available notice
- Official Notice Date: June 23, 2026
- Exposed Information: Names, dates of birth, addresses, contact details, medical record numbers, dates of service, diagnosis and treatment information, and potentially health insurance information
- Affected Population: All patients seen at the Catonsville, Maryland location; a numerical total was not disclosed
What Happened?
According to Dermatology Partners’ substitute privacy notice posted on June 23, 2026, an unauthorized individual accessed the organization’s data system between February 27 and March 10, 2026. The reported incident concerned its Catonsville location at 716 Maiden Choice Lane, Suite 305, Catonsville, Maryland.
Dermatology Partners stated that it found no evidence that information was copied or removed. However, the organization reported that it could not determine which patient records may have been viewed. It therefore notified all patients seen at the Catonsville location out of an abundance of caution. The notice did not identify a specific number of affected individuals or disclose when the unauthorized access was first discovered.
Dermatology Partners reported that it conducted a forensic review, cooperated with ongoing investigations, enhanced its access controls, and engaged cybersecurity professionals. The notice was posted as a substitute notice under the HIPAA Breach Notification Rule.
What Information Was Exposed?
Dermatology Partners reported that the information potentially viewable in the affected system may have included the following patient data:
- Names and dates of birth
- Addresses and other contact information
- Medical record numbers and dates of service
- Diagnosis and treatment information
- Potentially, health insurance information
The notice does not establish that every listed data element was viewable for every patient. Nevertheless, medical and insurance information can be used in fraudulent patient billing, false insurance verification requests, prescription-related scams, or medical identity theft. Patients should be cautious about unexpected communications that reference a provider, diagnosis, appointment, insurance plan, or medical bill to appear legitimate.
What Should You Do Next?
- Preserve the notice and verify communications: Keep copies of any letter, email, or substitute notice connected to the incident. Use a verified telephone number or website rather than links or numbers in an unexpected message claiming to concern Dermatology Partners.
- Review medical and insurance records: Examine explanations of benefits, patient portal activity, bills, and insurance claim histories for unfamiliar providers, services, prescriptions, or equipment. Report discrepancies promptly to the provider and insurer.
- Watch for healthcare phishing: Be skeptical of callers or messages requesting payment, insurance credentials, portal passwords, or identity information. Criminals may impersonate medical offices or insurers and refer to real patient details to make a request seem authentic.
- Monitor credit reports and accounts: Obtain free credit reports through AnnualCreditReport.com and review them for unfamiliar accounts or inquiries. If you detect suspicious activity, consider whether a fraud alert or security freeze is appropriate.
- Document suspected harm: Save fraudulent bills, claim denials, collection notices, suspicious messages, and records of time spent addressing the issue. This documentation may help when disputing errors, reporting identity theft, or requesting a legal review.
Your Legal Rights
People whose personal or health information may have been involved in a data incident can have rights under federal and state privacy, consumer-protection, breach-notification, or negligence laws. Which rights apply depends on factors such as the information involved, applicable jurisdiction, security practices, notice procedures, and whether the incident caused financial or other legally recognized harm.
The posting of a HIPAA substitute notice does not, by itself, establish liability, prove that information was misused, or confirm that every patient has a legal claim. Potentially affected individuals may wish to preserve relevant records and consult a data privacy attorney about available options. General information about legal rights is not a substitute for individualized legal advice.
Why Hire Strauss Borrelli PLLC?
Strauss Borrelli PLLC represents consumers in privacy and data security matters and evaluates reported incidents involving sensitive medical and personal information. The firm can review the available notice, assess whether applicable law may provide a remedy, and explain potential options in clear terms. A confidential consultation can help affected patients understand the process without assuming that misuse, liability, or eligibility for compensation has already been established.
If you received a breach notification letter from Dermatology Partners:
We would like to speak with you about your rights and potential legal remedies in response to this data breach. Please fill out the form, below, or contact us at 872.263.1100 or sam@straussborrelli.com.
