For years, healthcare organizations have encouraged patients to become more digitally connected to their care.
Use the patient portal. Check your test results online. Respond to appointment reminders. Communicate electronically with your care team. Use digital tools to take a more active role in managing your health.
Patients listened.
That progress has made digital engagement an important part of the healthcare experience. Unfortunately, cybercriminals understand that relationship, too.
Recent phishing campaigns impersonating MyChart demonstrate an important evolution in healthcare cyber risk. Attackers are using fraudulent emails, text messages, phone calls, and websites designed to look like familiar healthcare communications. Some promise free Medicare kits or health-related products. More concerning schemes have used fake MyChart websites and fabricated medical information to create urgency around supposedly critical test results.
The technology may be fraudulent, but the emotion it creates is very real.
Imagine receiving a notification that appears to come from your healthcare provider telling you that abnormal laboratory results require immediate attention. In that moment, most patients aren’t thinking like cybersecurity professionals. They’re thinking like patients.
What did they find? Is something wrong? What do I need to do?
That is precisely what makes these attacks so effective.
Cybercriminals Aren’t Just Exploiting Technology. They’re Exploiting Trust.
Healthcare has always operated on trust. Patients trust clinicians with deeply personal information and life-changing decisions. Increasingly, they must also trust the digital systems through which healthcare is delivered.
That makes cybersecurity part of the patient experience.
When an attacker impersonates a patient portal, the immediate objective may be to steal credentials or financial information, or to install malware. But there is another consequence healthcare leaders should consider: every convincing impersonation can make patients a little less certain about whether the next legitimate communication can be trusted.
That matters.
If patients become afraid to click an authentic appointment notification, access a test result, or respond to a message from their care team, the consequences move beyond information security. Security friction can become healthcare friction.
Trust is part of the treatment.
Protecting it requires healthcare organizations to think beyond defending their own infrastructure. The organization’s digital identity, and the communications patients associate with it, must also be protected.
Healthcare Organizations Need to Protect the Digital Relationship
The first priority is prevention. Healthcare organizations should continue strengthening email security, identity protections, multifactor authentication, domain protections, and monitoring for brand impersonation and lookalike domains. But technology alone is not enough.
Organizations should establish recognizable and consistent patterns for patient communications. Patients should know how their healthcare organization communicates, which domains and phone numbers it uses, what information it will request electronically, and, equally important, what it will never request.
Healthcare organizations should also make the trusted path easy to find.
Instead of asking patients to determine whether every link is authentic, teach a simpler behavior: when something feels unexpected, urgent, or unusual, leave the message and access the patient portal through the healthcare organization’s official app or known website.
Security, communications, digital health, patient experience, and clinical leadership should also have a coordinated response plan for patient-targeted impersonation campaigns. When a campaign emerges, organizations need to communicate quickly and consistently across their websites, patient portals, call centers, clinical practices, and other trusted channels.
This is an important distinction: an organization does not need to have suffered a breach for a cyberattack to affect its patients. Someone impersonating your organization can create risk for the people you serve even when your own systems remain secure.
Patients Have a Role, Too
Patients should approach unexpected healthcare messages with healthy skepticism, particularly those that create urgency, offer free products, or request personal, insurance, financial, or login information.
A few habits can dramatically reduce risk:
- Access MyChart through the official mobile application or the healthcare provider’s known website rather than through an unexpected message.
- Never provide passwords or verification codes by email, text, or phone. Legitimate MyChart support will not request them through those channels.
- Be suspicious of unexpected offers for free healthcare products, Medicare kits, prizes, or rewards.
- Never follow instructions from a website telling you to run commands, install software, or bypass a computer security warning.
- If a message involves an alarming diagnosis or unexpected medical result, verify it through the official patient portal or contact the healthcare provider directly.
Patients who believe they interacted with a fraudulent message should change their portal credentials, review their contact information and account activity, and contact their healthcare organization’s support team.
But we should be careful not to place the entire burden on patients.
Modern phishing attacks are becoming increasingly sophisticated. Generative AI makes it easier to produce convincing language, personalize messages, and replicate trusted communications at scale. “Look for spelling mistakes” is no longer an adequate cybersecurity strategy.
The safer approach is to make verification habitual and simple.
Protecting Confidence in Digital Care
Healthcare’s digital transformation depends on patients being willing to engage with technology.
We want patients checking their records. We want them communicating with clinicians. We want them using digital tools to schedule appointments, manage medications, review test results, and participate more actively in their care.
Cybersecurity therefore has a responsibility beyond protecting systems and data. It must help preserve patients’ confidence in those interactions.
The MyChart phishing campaigns offer an important reminder for healthcare leaders: cybercriminals will exploit not only our vulnerabilities, but also the relationships and trusted brands we have worked for years to build.
The answer isn’t to make patients afraid of digital healthcare.
It’s to make trustworthy digital healthcare easier to recognize and harder to impersonate.
Because in an increasingly connected healthcare ecosystem, protecting the patient means protecting the technology, the communication, and the confidence that connects them.
Trust is part of the treatment.
About Cindi Carter
Cindi Carter is a global, multi-industry Cybersecurity and Information Technology Executive who consistently delivers the optimal outcome. As a transformational leader from startups to enterprises she excels at building cybersecurity practices in highly regulated industries, turning strategic goals into action, and highly collaborative engagement to lead the organization in managing cyber risk. At Check Point Software Technologies, Cindi is a Global Chief Information Security Officer in the Office of the CISO, leading Check Point’s Healthcare Center of Excellence where human safety is essential to care. With over two decades in the healthcare and financial industries, Cindi’s purpose is deeply rooted in human safety, bringing together the capabilities that protect the security and privacy of each individual.
