Example Engagement: Securing Clinical Images and Building Telehealth at a Dermatology Practice

The practice operates two locations in Long Beach and Seal Beach, California. It employs 24 people — three board-certified dermatologists, two physician assistants, an aesthetician, medical assistants, front desk staff, and a billing team. They handle the full spectrum: medical dermatology (skin cancer screenings, biopsies, acne, eczema, psoriasis), surgical procedures (Mohs surgery, excisions), and cosmetic services (Botox, fillers, laser treatments, chemical peels).

It generated strong revenue from both the medical and cosmetic sides. But behind the clinical success, the technology and compliance infrastructure had been neglected for years. A combination of rapid growth, multiple service lines, and an expanding photo library created risks that the founding partner hadn't fully appreciated until a close call forced the issue.

50,000 Patient Photos on an Unsecured System

Clinical photography is essential in dermatology. Tracking mole changes over time, documenting skin cancer progression, recording pre-and-post-treatment results for cosmetic procedures, and capturing biopsy sites for surgical planning — the practice took thousands of photos per year. Over eight years, the library had grown to more than 50,000 images.

Every photo lived on a shared network drive accessible from both locations. There were no access controls — any employee at either office could browse every patient's images. Photos were organized by date, not by patient, making it nearly impossible to pull a specific patient's full image history without searching through folders manually.

Four clinical staff members regularly copied photos to personal phones for reference between locations. Those images synced automatically to personal iCloud and Google Photos accounts. One PA had three years of dermoscopy images on her personal iPad — high-resolution photos of patients' moles, lesions, and biopsy sites stored on an unmanaged device with no encryption and no remote wipe capability.

The close call came when a medical assistant's personal phone was stolen from her car. The phone had 400+ patient photos with no passcode lock enabled. The practice had no way to remotely wipe the device, no incident response plan, and no process for notifying affected patients. They got lucky — the phone was recovered by police two days later, apparently untouched. But it exposed a gap that could have resulted in a reportable breach affecting hundreds of patients.

Telehealth on Consumer Video Platforms

During the pandemic, the practice launched teledermatology using standard Zoom accounts. When enforcement relaxed, the practice kept using them. Three years later, they were still conducting 30 to 40 virtual visits per week on consumer Zoom — not HIPAA-compliant, not encrypted end-to-end for healthcare, and not integrated with their EHR.

Teledermatology visits involved patients showing skin concerns on camera while providers took screenshots and added them to the patient chart manually. Those screenshots were saved to local desktops, then dragged into the EHR — a workflow with multiple points where unencrypted PHI lived on unmanaged devices. Visit recordings (when providers saved them for documentation) sat in a Zoom cloud account with no BAA in place.

The practice had no telehealth consent workflow, no documentation of HIPAA-compliant video infrastructure, and no audit trail for virtual visits beyond the EHR note.

Two Locations, No Unified IT

Each location had been set up independently. The Long Beach office ran on a local server from 2019. The Seal Beach office used a different setup built by a different tech. Neither location had remote monitoring. Neither had automated patching. The practice management system and EHR worked at both locations but ran slowly because the inter-office connection was a basic VPN that dropped regularly.

When the VPN went down, providers at Seal Beach couldn't access Long Beach patient charts. This happened two to three times per month, usually lasting 30 to 60 minutes each time. During Mohs surgery days — when the surgeon operates at Long Beach and needs pathology images sent to the lab in real time — a network interruption meant the patient waited on the table while staff scrambled to restore the connection.

Backups existed at the Long Beach location but hadn't been tested. The Seal Beach office had no backup system. An equipment failure or ransomware attack at Seal Beach would wipe out three years of patient records with no recovery option.

HIPAA Compliance Was Surface-Level

The practice had a template HIPAA compliance binder purchased online in 2020. It contained generic policies that had never been customized, reviewed, or distributed to staff. No security risk assessment had ever been conducted. No Business Associate Agreements existed with their EHR vendor, photo storage system, billing clearinghouse, Zoom, lab courier service, or pathology lab. Staff had never completed HIPAA training.

For a practice handling 50,000 clinical images, conducting telehealth visits, performing surgical procedures, and operating across two locations, the compliance exposure was severe.

The Phones Were Losing New Patients

The practice received 90 to 110 calls per day across both locations. The call mix was split between medical (skin checks, biopsy results, medication refills, referrals) and cosmetic (pricing, procedure questions, consultation bookings, package inquiries). Two front desk employees at each location handled everything — phones, check-in, scheduling, insurance verification, and payments.

Hold times during peak hours stretched past three minutes. Voicemails stacked up — 18 to 22 per day — with callbacks happening 24 to 48 hours later. For cosmetic inquiries, that delay was a deal-killer. Patients shopping for Botox or laser treatments called multiple providers. Whoever answered first usually won the booking.

After 5 PM and on weekends, all calls went to voicemail. The practice tracked new patient sources and found that 38% of cosmetic consultations originated from evening web browsing — patients who researched procedures, looked at reviews, and then called. Those calls went unanswered. The founding partner estimated the practice lost 8 to 12 cosmetic consultations per week to voicemail alone.

We assessed both locations over four days — every device, network path, server, photo storage system, telehealth workflow, vendor relationship, and compliance document. The findings: 26 critical vulnerabilities, 50,000+ patient photos on an unsecured shared drive, a telehealth platform with no HIPAA compliance, zero documentation that would survive an audit, and a front desk losing new patients daily.

We built a 75-day remediation plan addressing cybersecurity, managed IT, HIPAA compliance, and front office operations across both sites.

Cybersecurity: Locking Down 50,000 Patient Images

• Secure photo management platform — we migrated all 50,000+ images from the shared network drive to an encrypted, HIPAA-compliant cloud storage system with role-based access controls. Providers access only their own patients' images. Front desk and billing staff cannot see clinical photos. Every access, download, and share is logged with a full audit trail.
• Personal device remediation — identified patient photos on 4 employees' personal devices. All images were securely transferred to the compliant platform and wiped from personal phones, tablets, and cloud accounts. We deployed a secure mobile app so providers can review images between locations without storing PHI on personal devices.
• Endpoint detection and response (EDR) on every workstation and server across both locations — active threat monitoring managed from a single cybersecurity dashboard.
• Business-grade firewalls with intrusion prevention at both sites. Network segmentation separating clinical operations, payment processing, telehealth, and guest Wi-Fi.
• Email security gateway — blocks phishing, spoofing, and malicious attachments. Encrypted email for any communication containing PHI or clinical images.
• Multi-factor authentication on every account. Shared logins eliminated. Every system access tied to an individual employee.
• Quarterly security awareness training with dermatology-specific phishing simulations — fake pathology report notifications, spoofed insurance pre-authorization emails, and counterfeit medical supply promotions.

Managed IT: Two Locations, Reliable Connectivity, Telehealth Infrastructure

• Encrypted SD-WAN connection between both locations — replaced the unreliable VPN. Both offices now operate on a single secure network with consistent, high-speed connectivity. Mohs surgery days no longer depend on a flaky VPN for pathology image transfers.
• HIPAA-compliant telehealth platform — replaced consumer Zoom with an encrypted, healthcare-grade video platform integrated with the EHR. Virtual visits now include automatic documentation, secure screen capture to the patient chart, consent workflows, and a full audit trail. BAA executed with the platform vendor.
• 24/7 remote monitoring and management across all devices at both locations. Automated patch management. Cloud backup with hourly snapshots at both sites — including the first backup system ever installed at Seal Beach.
• Dedicated help desk for both offices — staff get support on the spot instead of waiting for a local tech.
• Device lifecycle management — audited all 26 devices, replaced 5 past end-of-life, enrolled everything in centralized management.

HIPAA Compliance: Photo-Heavy Practice Done Right

• Full security risk assessment covering both locations — every system, every data flow, every vendor, and every clinical photography workflow documented with remediation tracking.
• 20 written policies and procedures — including dermatology-specific policies for clinical photography consent, dermoscopy image storage, telehealth documentation, before-and-after photo use in marketing, and social media use of patient images.
• Business Associate Agreements — identified 10 vendors who handle PHI (EHR, photo storage, telehealth platform, billing clearinghouse, pathology lab, lab courier, cloud backup, email provider, shredding service, IT suppliers) and executed signed BAAs with each.
• Staff HIPAA training — all 24 employees completed training covering clinical photography rules, telehealth compliance, personal device policies, and consent documentation. New hires complete training before receiving system access.
• Breach response plan — step-by-step playbook including specific procedures for photo-related incidents (stolen devices, unauthorized image sharing, social media violations).

AI Receptionist: Medical and Cosmetic Calls Handled Separately

We deployed an AI-powered phone receptionist across both locations, configured to handle the unique dual nature of a derm practice — medical and cosmetic calls require different responses, different routing, and different urgency levels.

• Cosmetic inquiry handling — the AI answers pricing questions, explains procedures and expected downtime, describes package options, and books cosmetic consultations. It provides the information prospective patients need to commit — without hold times or voicemail.
• Medical call routing — biopsy result inquiries, medication questions, and urgent skin concerns get routed to clinical staff with full context. The AI gathers relevant details before connecting so the nurse knows who's calling and why.
• After-hours and weekend coverage — cosmetic patients browsing at 9 PM can ask questions and book consultations. Medical patients calling after hours about a suspicious mole or post-procedure concern get appropriate guidance and next-day appointment booking.
• Appointment scheduling — connects to the practice management system in real time. Books medical and cosmetic appointments at either location based on provider availability and patient preference.
• Cross-location booking — when one location is fully booked, the AI offers available slots at the other. Patients see it as flexibility. The practice fills chairs.

The full deployment was completed in 75 days across both locations. See our pricing page for what a practice this size pays monthly.

Cybersecurity: A Clinical Image Library That Is Actually Protected

A dermatology practice accumulates an enormous photographic record, and those images are unambiguously protected health information. They move off shared drives and personal devices into encrypted, access-controlled storage with audit logging, so it is possible to answer who viewed what and when.

Endpoint protection, email filtering and MFA close the routes that are actually used against practices this size.

Managed IT: Telehealth That Holds Up Mid-Consultation

Network and connectivity work is what makes teledermatology usable — a dropped call during a lesion assessment is a clinical problem, not an inconvenience. Sessions run without drops, and image-heavy consultations load at a speed clinicians will tolerate.

HIPAA: Documentation That Covers Photography

Standard compliance kits do not address clinical imaging: consent, retention, transmission, and who may access the archive. Those policies get written, the BAAs get signed, and staff training covers the photography workflow specifically, because that is where this speciality is most exposed.

AI Receptionist: Cosmetic Enquiries Answered When They Arrive

Cosmetic enquiries are impulsive and research-driven — people read reviews in the evening and call immediately. The AI receptionist answers those calls, qualifies them and books, instead of leaving them to a voicemail box that is cleared the following afternoon.

Running a dermatology practice with patient images on personal devices and cosmetic inquiries going to voicemail? Book a free consultation and we'll assess your photo security, telehealth compliance, IT infrastructure, and front office operations.