Dr. Doug's Pediatric Dentistry Data Breach 2025: 3,590 Pediatric Patients Exposed (Logan, UT). SSNs, Driver's Licenses, Medicaid, Dental Records. What To Do

What happened

Dr. Doug’s Pediatric Dentistry is a Logan, Utah pediatric dental practice offering operative dentistry, oral sedation, hospital anesthesia, and early orthodontics. In September 2024, the practice detected unusual activity in a single employee’s email account. The password was reset and a forensic investigation was launched. The investigation, completed in June 2025, confirmed that the compromise was confined to that one mailbox and no other systems or networks were affected. Investigators were not able to determine with certainty whether any specific email in the account was actually opened by the unauthorized party, so the practice notified out of an abundance of caution.

The practice filed a HIPAA breach notification with the HHS Office for Civil Rights on August 11, 2025, reporting 3,590 affected current and former patients. A substitute notice was published on the practice’s website and mailed notification letters began going out on August 14, 2025.

Timeline

• September 2024 — Unusual activity flagged in one employee email account; password reset; forensic firm engaged.
• June 2025 — Forensic review concludes. Specific exposed data elements identified.
• August 11, 2025 — HHS OCR breach report filed: 3,590 individuals.
• August 14, 2025 — Substitute notice posted; mailed letters begin.
• August 18, 2025 — Strauss Borrelli PLLC announces class-action investigation.

What was exposed

Per the practice’s own substitute notice, the exposed information may include:

• Name
• Date of birth
• Diagnosis or dental treatment information
• Medicaid information
• Dental insurance information

For a limited subset of individuals, the exposed information additionally included:

• Social Security number
• Driver’s license number

Not every data element was involved for every patient.

Why this matters more for pediatric patients

The overwhelming majority of Dr. Doug’s patient base is children. Pediatric Social Security number and Medicaid exposure is among the highest-severity categories of breach data because child identity theft typically goes undetected for years. Parents do not routinely monitor minor credit files, and most damage only surfaces when the child applies for their first credit card, student loan, lease, or job. By that point the synthetic-identity trail may be a decade deep.

Medicaid numbers are particularly attractive to medical identity thieves because they tie to public-benefit eligibility and can be used to bill fraudulent services in the child’s name — corrupting the medical record long before the family ever notices.

What Dr. Doug’s is offering

The practice’s notice does not include a complimentary identity-monitoring or credit-monitoring enrollment. Affected patients are instead directed to:

• A dedicated toll-free call center: 833-594-5308, Monday to Friday, 7 a.m. to 7 p.m. Mountain Time
• Generic recommendations to “remain vigilant” and review account statements
• Generic recommendations to sign up for free credit monitoring “if offered” — but none is provided by the practice itself

The absence of practice-funded credit monitoring is notable given that Social Security numbers and driver’s license numbers were confirmed exposed for a subset of the 3,590 affected.

Class-action investigation

Strauss Borrelli PLLC announced a class-action investigation on August 18, 2025, soliciting affected individuals to discuss potential legal remedies. No class complaint has been publicly docketed as of this page’s last update — the matter remains in pre-suit investigation. We will update this page if and when a complaint is filed.

What to do if you may be affected

1. Call 833-594-5308 to confirm whether your child is on the affected list and to request the specific data elements exposed for your child.
2. Freeze your child’s credit at all three bureaus (Equifax, Experian, TransUnion). Minors require manual outreach with proof of guardianship — start the process today. A child credit freeze is the strongest available protection against synthetic identity theft.
3. Freeze your own credit if you are the financially responsible party on the dental account (Medicaid and insurance records may include parent identifiers).
4. File IRS Form 14039 in your child’s name if their Social Security number was exposed. This flags the SSN against fraudulent tax-return filings.
5. Check your child’s Social Security earnings history annually starting at age 14 — unauthorized earnings reports are an early sign that the SSN is being used.
6. Contact your state Medicaid office to flag the account for potential medical-identity-theft monitoring if Medicaid information was exposed.
7. Preserve the notification letter. If a class action proceeds, the letter is your proof of standing. If your child encounters identity-theft issues at age 18+, the documentation supports disputes.
8. Stop the ongoing flow of your child’s dental records. HealthConsent files HIPAA restriction requests so the pediatric dental data exposed in this breach is not continuously re-shared.

Sources

• HHS Office for Civil Rights Breach Portal — federal regulatory record (3,590 affected; filed August 11, 2025).
• Dr. Doug’s Pediatric Dentistry: Notice of Data Security Incident — entity’s own substitute notice (PR Newswire, August 14, 2025).
• Strauss Borrelli PLLC: Investigation Announcement — class-action investigation, August 18, 2025.
• ClaimDepot: Dr. Doug’s Pediatric Dentistry Data Breach Update — aggregated incident summary.
• Becker’s Dental Review: 15 Data Breaches That Impacted Dentistry in 2025 — dental-industry trade-press coverage.
• Morningstar / PR Newswire mirror — secondary mirror of the substitute notice.

Continue reading

• Your eight HIPAA rights, in plain English
• Other 2025 healthcare data breaches