Dive Brief:

  • More than a dozen health systems across the U.S. are warning patients of a phishing attempt where scammers are trying to trick patients into providing personal information by sending emails masquerading as MyChart, Epic’s patient portal.
  • The cybercriminals are leveraging MyChart’s name and logo to target patients by offering a free “senior health package” or “MyChart Medicare kit,” according to a post on Texas Health’s website, one of the health systems warning patients of the scam.
  • Other health systems that have issued warnings include South Dakota-based Avera Health, Methodist Health System in Texas, Premier Health in Ohio, and Sentara Health in Virginia.


Dive Insight:

The message typically asks the recipient to click a link to claim an offer, leading patients to a page that directs them to provide personal information. The scam message might contain spelling mistakes or unusual wording and come from an unfamiliar email address, Texas Health said.

In July, Epic’s Trevor Berceau, director of research and development, said MyChart had seen an uptick in scammers trying to use its brand to trick patients. Scammers had sent fraudulent messages through email, text messages, and phone calls.

“The increase in attempts is due to scammers taking advantage of the popularity of the MyChart brand rather than any security concern, so you can continue to use MyChart as normal,” Berceau wrote. “If something doesn’t feel right, however, stop and check.”

Epic has cautioned users to be skeptical of free offers sent over email. Users should check the sender and web address when they receive an email, and MyChart will never ask patients to press keyboard shortcuts or change the email addresses or phone numbers associated with their accounts, Epic said.

Epic did not respond to a request for comment by publication time.

Phishing is a common cyberattack tactic with a high success rate — healthcare organizations are more susceptible to phishing than any other major industry, according to data. Additionally, artificial intelligence is making it easier for cybercriminals to craft a high volume of phishing messages that appear legitimate, heightening the threat level for the industry.