August 28, 2025
We’ve all received an email that’s a little too good to be true.
Maybe it’s a “Congratulations, you’ve won a free vacation!” message, or a heartfelt request from an “international prince” who just needs your bank details. While these examples may sound obvious, phishing emails today are far more convincing, using logos, sender names, and even tone that mirror trusted organizations.
However, healthcare staff have an even bigger target on their backs due to the sensitive nature of Protected Health Information (PHI). Healthcare staff, from the office manager to the doctor, are close to patients’ Social Security Numbers, billing information, and more, all of which are a goldmine for a malicious actor.
In light of the most recent $170,000 phishing HIPAA fine, it’s essential to review the best tips for keeping your email and patient data secure.
Email Safety 101
When hackers send 3.4 billion phishing emails daily, it’s essential to remain vigilant when reviewing emails. One mistaken click can jeopardize thousands of health records, so always carefully read your emails.
While your spam filter might hide some risky emails, phishing has become more advanced, including spoofing staff members and, in general, looking legitimate upon first glance.
First, when receiving an email, always think before you click. Does the email look suspicious? Is the grammar odd? Are there unnecessary attachments? Never download any attachments unless you are sure of the sender. A hacker could expose your entire practice to ransomware with one unsafe attachment. All it takes is one click.
When receiving an email, always ensure the account looks authentic. A familiar name doesn’t always mean a safe email. Cybercriminals are betting on healthcare staff not knowing the difference between ‘yourboss@email.com’ and ‘y0urboss@email.com’. The internet also provides hackers access to public posts, so even if the profile photo might be of your boss, chances are it isn’t your boss sending you an email demanding personal information.
Watch for common red flags. If an email feels unusual, pause before acting, especially with messages marked as “urgent.” Cybercriminals rely on panic to push quick clicks. For example, an email shouting “WARNING: Update your EHR immediately using this link” is likely a scam designed to trick you into handing over access.
Delete spam emails or forward them to your phishing IT team (if applicable, likely for larger organizations), and ensure your team is aware of any threats and trained to identify and handle them appropriately.
Keeping it Secure
Phishing emails aren’t rare; they’re routine.
That’s why it’s critical to give your staff the tools they need to safeguard PHI. A strong compliance program goes beyond policies by providing hands-on email safety training, encouraging protections like multi-factor authentication, and connecting your practice with trusted IT resources.
Meet with an expert today to learn more about HIPAA compliance and email safety.
