The email says you have won a MyChart Medicare Kit. You have not, and the message did not come from your hospital.
More than a dozen U.S. health systems have warned patients about a phishing campaign built around exactly that kind of bait. HIPAA Journal reported the warnings on August 26. Some messages offer other healthcare benefits, Medicare packages, free gifts or rewards. Texas Health Resources told patients that some emails pushed a “Senior Health Package.”
Methodist Health System, Premier Health, Sentara Health, Metro Health and Texas Health Resources, all of which run Epic Systems’ health records and MyChart portals, have put scam notices on their websites. The scammer most likely wants MyChart credentials, Medicare details, financial account information or other sensitive data.
A logo, not a breach
The emails do not come from genuine provider addresses or domains. They carry a MyChart logo to look authentic, but Epic did not send them. No vulnerability is involved.
“We’ve seen an uptick in scammers trying to trick patients by using the MyChart name or logo to make emails, text messages, phone calls, and websites look official,” said Trevor Berceau, Director R&D at Epic Systems. He said the rise comes from scammers taking advantage of the popularity of the MyChart brand rather than any security concern, so patients can keep using MyChart as normal. “If something doesn’t feel right, however, stop and check.”
Nobody has been identified as the attacker. It is also unclear how they got patients’ contact details. The likeliest answer is an earlier data breach, though not necessarily one at the patient’s own provider.
What patients should do
Check the sender address and domain. Watch for spelling and grammar mistakes, unusual requests, free gifts and demands for immediate action. If in doubt, contact the provider using verified contact information, never the details in the suspicious message.
Delete the email. Do not click any link, including an unsubscribe link, and do not reply. A patient who clicked a link or tried to log in should reset the MyChart password and contact the provider’s MyChart support team.
