35,295 Individuals and a Phone Call From the Vendor: What the Universal Dermatology & Vein Care Incident Asks of Small Practices
If your practice has no IT team, and no single place to keep vendor alerts, incident records, and follow-up: an important security event can quickly become a scramble to reconstruct what happened and what your organization knew.
For a small practice, that scramble is more than an administrative headache. HIPAA-related penalties, response costs, interrupted operations, and loss of trust can strain finances and threaten the business itself. In a high-stakes moment, leaders need a reliable record of the facts, decisions, and actions, not scattered emails and someone’s memory.
The Universal Dermatology & Vein Care incident offers small practices a useful, sobering question: if a vendor is the one that alerts you, can your team assemble a clear account of the incident and its response?
What the public record reports
Universal Dermatology & Vein Care is a dermatology practice with Central Ohio locations in Dublin, Lewis Center, and Mount Vernon, Ohio. Its notice was signed by George Skandamis, MD, FAAD.
CareCloud, a business associate providing data storage services to the practice, reported that a hacker gained access to one of its AWS environments between March 10 and March 16, 2026. The practice reported that it received an alert from CareCloud and discovered the incident on July 8, 2026, and that it immediately contacted CareCloud to investigate further.
The notice identified exactly 35,295 individuals, including 8 New Hampshire residents. It listed the potentially involved data elements as: name, treatment information, dates of service, medical record number, health insurance information, Social Security number.
September 30, 2026, is the date the practice arranged notification to affected individuals and mailed letters. The HHS OCR breach portal lists a submission date of 09/30/2026 for the incident, described as a Hacking/IT Incident involving a Network Server, with the case under investigation. The portal also lists the state as FL, while the practice operates in Central Ohio; it provides no explanation for the difference. A listing is a submission. It is not, by itself, a finding of a violation or a fine.
Counsel’s letter to the New Hampshire Attorney General, from Jackson Lewis P.C.’s Tampa, Florida office, is stamped received October 13, 2026.
The notice states that CareCloud secured the affected environment, confirmed no persistent unauthorized access remained, and continues to strengthen its systems. It also says the practice arranged 12 months of Experian IdentityWorks credit monitoring and related services for individuals whose Social Security number was involved.
These are separate facts as the entities reported them. They are not a basis for drawing conclusions about anyone’s conduct.
The operational question for a small practice
When an incident begins with a vendor’s alert, the practice still needs its own usable record of what it was told, what information was confirmed, which internal steps were taken, and what notification was arranged. That record may involve communications and documentation from multiple organizations, but a practice should be able to locate its own records without relying on scattered inboxes or a single person’s recollection.
This is not about assigning responsibility between a practice and a vendor. It is about being prepared to answer practical questions: Who received the alert? Where was it recorded? How were affected information types confirmed? Which staff members were informed? Where is the relevant vendor documentation? Can the practice show its training records, access records, risk analysis, and applicable policies?
The U.S. Department of Health and Human Services’ HIPAA Security Rule guidance and risk analysis guidance describe the importance of documented safeguards and ongoing risk management. NIST’s SP 800-66 Rev. 2 provides practical resources for understanding and implementing the Security Rule. For a practice, the day-to-day challenge is making those responsibilities concrete, organized, and reviewable.
Six safeguards that turn scattered records into a usable response
The goal is not to promise that an incident will never happen. It is to make the practice’s security responsibilities and response records easier to maintain and retrieve.
1. Access Tracking
Maintain a current record of staff access levels, role changes, and access updates. Where relevant, keep vendor access information and related changes organized as well. When an incident raises questions about access, a record of who had which level of access, and when that changed, helps the practice establish the facts it can document.
2. Incident Reporting
Record alerts, suspected events, confirmed incidents, actions taken, and follow-up in a consistent place. For vendor-related events, preserve the alert and related communications alongside the practice’s own incident record. Include the information the practice received, the steps it took, and any relevant notification records. A structured process makes the incident history easier to review later.
3. Awareness Training
Training should be assigned, completed, and tracked, not left to informal reminders. Staff need to know how to report a suspicious message, unexpected system behavior, or a concern involving ePHI. Tracking annual cyber-awareness training gives practice leaders a record of who completed training and when, and helps keep reporting expectations visible to the team.
4. Risk Analysis
Keep a documented view of the practice’s risks to electronic Protected Health Information (ePHI), including dependencies on external services and the safeguards used to manage identified risks. Review the analysis when operations, systems, vendors, or workflows change. HHS and NIST guidance can help practices understand the purpose and scope of this work; the specific analysis should reflect the organization’s environment.
5. HIPAA-Aligned Policies
Maintain clear, current policies that explain how the practice handles access, workforce training, incident reporting, and vendor-related documentation. Staff should know where the policies are, what actions they are expected to take, and how policy acknowledgements or updates are recorded. Policies are most useful when they match the practice’s actual workflows.
6. Audit Trail
Keep a traceable record of what the practice documented, when it was recorded, and who completed or updated it. The audit trail should make it practical to find access records, incident entries, training completion, risk analysis, and policy acknowledgements together. It can help leaders review their own records and respond to questions with greater clarity.
From incident facts to operational clarity
Veri-Hub is a documentation and workflow management system and a Security and Access Management System. It does not prevent every incident or guarantee compliance or any audit outcome.
The platform helps small practices organize access-level documentation, incident response reporting, annual awareness training tracking, risk analysis records, and HIPAA-aligned policies, alongside an audit trail. That structure can support a more orderly response when the first information arrives from a vendor and the practice needs to gather its own records.
I’m Darlene Collins, RN, BSN, Certified Cybersecurity & Risk Expert. I have more than 30 years in healthcare and more than 25 years implementing EHR systems, including Epic, and working with regulatory compliance. We live this experience. My work has taught me that security and risk responsibilities must be workable for the people managing care and operations every day.
The stakes are real: being organized does not erase an incident, but disorganized records can make an already difficult moment harder. A practice that can locate its alert record, vendor documentation, access history, staff training, risk analysis, policies, and follow-up has a clearer foundation for managing its responsibilities, and protecting its ability to keep serving the community.
For more information about Veri-Se3ure, visit veri-se3ure.com. To discuss your practice’s documentation and workflow needs, book a consultation.
Sources
This content is provided for informational purposes only and does not constitute legal advice. Organizations should consult qualified legal and cybersecurity professionals regarding their specific HIPAA responsibilities.
Comments