Shelby Dermatology Data Breach Report

Incident Overview

Shelby Dermatology, operating under the business name Dermatologists of Birmingham in Alabama, experienced a significant data breach involving unauthorized access to its network server infrastructure. The breach was reported to the U.S. Department of Health and Human Services on May 2, 2025, affecting approximately 86,414 individuals. This incident represents a hacking or IT-related compromise of the organization's computer systems, resulting in potential exposure of protected health information (PHI) maintained on networked servers. The breach occurred without involvement of any business associates, indicating the compromise was limited to Shelby Dermatology's own infrastructure and systems.

Discovery and Response Timeline

While specific discovery dates are not detailed in the breach submission, the May 2, 2025 submission date indicates the organization completed its investigation and notification process within the required HIPAA timeframe. Upon discovery of the unauthorized access, Shelby Dermatology initiated standard breach response protocols including forensic investigation of affected systems, determination of the scope of compromised data, and preparation of notification communications required under HIPAA Breach Notification Rule (45 CFR §§ 164.400-414). The organization was required to notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery of the breach. Additionally, notification to the HHS Office for Civil Rights and potentially to media outlets (depending on the number affected) would have been required as part of the mandatory disclosure process.

Technical Details of the Breach

Network server breaches typically involve unauthorized access to centralized data repositories where patient records, appointment information, billing data, and clinical notes are stored. The compromise of a network server suggests either exploitation of unpatched vulnerabilities, weak authentication credentials, malware infection, or other IT security failures that allowed threat actors to gain access to systems containing PHI. Network-based attacks on healthcare organizations commonly involve ransomware deployment, data exfiltration, or lateral movement through connected systems. The fact that this breach affected over 86,000 individuals indicates the compromised server(s) contained a substantial portion of the organization's patient database. Dermatology practices typically maintain detailed patient records including medical histories, treatment plans, photographs of skin conditions, and associated billing information—all of which constitute sensitive PHI.

Organizational Context

Shelby Dermatology, doing business as Dermatologists of Birmingham, operates as a dermatological medical practice in Alabama. The organization provides specialized dermatological services to patients throughout the region. With 86,414 affected individuals, this represents a substantial patient population, suggesting either a large multi-location practice, a long operational history with accumulated patient records, or both. Dermatology practices maintain particularly sensitive information including photographic documentation of skin conditions, which can reveal medical conditions and may be considered more sensitive than text-based medical records. The breach's impact on such a large patient population indicates the organization's network infrastructure contained centralized, consolidated patient data repositories rather than distributed or segmented systems.

Patient Impact and Notification

Approximately 86,414 individuals had their protected health information potentially exposed through the network server compromise. This substantial number of affected patients represents a significant breach requiring comprehensive notification efforts. Affected individuals likely include current and former patients of Shelby Dermatology whose records were maintained on the compromised server infrastructure. The types of information potentially exposed would typically include names, addresses, dates of birth, Social Security numbers, insurance information, medical record numbers, diagnoses, treatment histories, and potentially photographic documentation of skin conditions. Under HIPAA requirements, Shelby Dermatology was obligated to provide written notification to each affected individual describing the nature of the breach, the types of information involved, steps the organization is taking to investigate and mitigate the breach, and recommended actions patients should take to protect themselves. The organization was also required to maintain a log of all individuals notified and provide this information to HHS.

HIPAA Compliance and Industry Context

This breach underscores the ongoing vulnerability of healthcare organizations to network-based attacks despite HIPAA's Security Rule requirements (45 CFR §§ 164.308-318). The Security Rule mandates that covered entities implement administrative, physical, and technical safeguards to protect ePHI, including access controls, encryption, audit controls, and integrity controls. Network server breaches affecting this volume of patients are not uncommon in the healthcare sector; according to HHS breach notification data, hacking and IT incidents represent one of the most frequent causes of healthcare data breaches. The healthcare industry remains a high-value target for cybercriminals due to the sensitivity and marketability of health information on the dark web. Dermatology practices, while typically smaller than hospital systems, maintain valuable patient data and may face resource constraints in implementing enterprise-grade cybersecurity measures. The breach notification requirement ensures patients can take protective measures such as credit monitoring and fraud detection, though the effectiveness of such measures depends on the specific data elements exposed and the sophistication of potential threat actors.