For years, healthcare organizations have encouraged patients to become more digitally connected to their care.

Use the patient portal. Check your test results online. Respond to appointment reminders. Communicate electronically with your care team. Use digital tools to take a more active role in managing your health.

That progress has made digital engagement an important part of the healthcare experience. Unfortunately, cybercriminals understand that relationship, too.

Recent phishing campaigns impersonating MyChart demonstrate an important evolution in healthcare cyber risk. Attackers are using fraudulent emails, text messages, phone calls, and websites designed to look like familiar healthcare communications. Some promise free Medicare kits or health-related products. More concerning schemes have used fake MyChart websites and fabricated medical information to create urgency around supposedly critical test results.

The technology may be fraudulent, but the emotion it creates is very real.

Imagine receiving a notification that appears to come from your healthcare provider telling you that abnormal laboratory results require immediate attention. In that moment, most patients aren’t thinking like cybersecurity professionals. They’re thinking like patients.

What did they find? Is something wrong? What do I need to do?

Healthcare has always operated on trust. Patients trust clinicians with deeply personal information and life-changing decisions. Increasingly, they must also trust the digital systems through which healthcare is delivered.

When an attacker impersonates a patient portal, the immediate objective may be to steal credentials or financial information, or to install malware. But there is another consequence healthcare leaders should consider: every convincing impersonation can make patients a little less certain about whether the next legitimate communication can be trusted.

Source link