Madison, August 26 — A phishing campaign targeting patients of several US healthcare systems has been reported, with fraudulent emails purporting to be sent via the MyChart patient portal. The emails, which are not sent from legitimate healthcare provider email addresses or domains, often claim recipients have won a MyChart Medicare Kit or offer other healthcare benefits, Medicare packages, free gifts, or rewards.
Trevor Berceau, Director of R&D at Epic Systems, stated that scammers are exploiting the popularity of the MyChart brand rather than exploiting any security vulnerability, and advised patients to continue using MyChart normally but to stop and verify if something feels suspicious. The threat actor behind the campaign remains unidentified, and it is unclear how contact information was obtained, though it is likely sourced from a prior data breach not necessarily tied to the healthcare provider.
Healthcare Providers Respond
Several healthcare providers using Epic Systems’ electronic health records and MyChart portals, including Methodist Health System, Premier Health, Sentara Health, Metro Health, and Texas Health Resources, have added scam warnings to their websites. Texas Health Resources specifically warned patients about emails offering a ‘Senior Health Package.’ Patient vigilance is crucial in preventing the scam, as the emails include a MyChart logo to appear legitimate, but have not been sent by Epic Systems.
Patients are advised to delete suspicious messages immediately, avoid clicking any links—including ‘unsubscribe’ links—not reply, and never disclose personal or financial information.
Protecting Patient Information
If a link was clicked or login attempted, patients should reset their MyChart password and contact their provider’s MyChart support team using verified contact information, not information from the suspicious message. Patients should remain vigilant against unsolicited communications offering free gifts or rewards, check sender details for legitimacy, and look for red flags such as spelling errors, grammatical mistakes, unusual requests, and urgent action demands.
The report was published by The HIPAA Journal, led by editor-in-chief Steve Alder, a specialist in healthcare industry legal and regulatory affairs with ten years of experience writing on the topic. As the situation continues to unfold, patients and healthcare providers will be watching for any developments in the phishing campaign and taking steps to protect sensitive information.
Looking Ahead
Under the hood, the technical reality of this phishing campaign highlights the importance of patient awareness and diligence in preventing scams. As ever, the detail that matters is the ability of patients to identify and report suspicious activity, and for healthcare providers to implement robust security measures to protect patient information. The US administration will likely be monitoring the situation, and patients can expect further guidance and support in the coming days.
