FORT WAYNE, Ind. (WOWO) — Cybersecurity experts and healthcare organizations are warning patients about a growing phishing scam that uses the trusted MyChart name to trick people into surrendering passwords, personal information and potentially access to their computers.
The scam involves realistic-looking emails and other messages that appear to come from MyChart. Some tell recipients that new medical test results are available, while others promote supposedly free Medicare kits or health packages.
The American Hospital Association reports that Epic, the company behind MyChart, has identified fraudulent messages that direct patients to fake websites designed to resemble legitimate MyChart login pages.
The danger begins when a recipient clicks the link and enters a username or password. Those credentials can then be captured by scammers and potentially used to gain access to other accounts if the same password has been reused elsewhere.
In some versions of the scam, the deception goes even further.
A victim may be shown fabricated medical information after entering credentials and then instructed to take additional steps to view or download what appears to be a medical report. Cybersecurity experts say those instructions can potentially lead to malware being installed on the victim’s computer.
Another version of the campaign promises a free Medicare-related package. Healthcare organizations have reported messages promoting supposed “MyChart Medicare Kits,” senior health packages and similar offers.
Those offers are not legitimate MyChart promotions.
The Pennsylvania Attorney General’s Office has warned consumers that the supposed Medicare kit is part of a phishing operation intended to collect sensitive information.
The scams are particularly effective because MyChart is a familiar healthcare tool used by patients to check test results, communicate with doctors, schedule appointments and manage medical information.
A legitimate-looking logo or reference to a patient’s healthcare provider, however, does not mean a message is authentic.
Healthcare organizations responding to the campaign say there is no indication that the MyChart platform itself has been breached as part of this activity. Instead, scammers are impersonating the MyChart brand and using fraudulent websites and messages to deceive individual users.
Experts say patients should be especially cautious when an unexpected message creates a sense of urgency.
A message announcing test results that a patient was not expecting, offering a free medical or Medicare product, demanding immediate action or asking for sensitive information should all be treated as potential warning signs.
Other red flags can include unfamiliar sender addresses, unusual website names, spelling or grammatical errors, requests for Medicare or insurance information and links that do not correspond with a patient’s normal healthcare provider.
Cybersecurity officials are also warning about instructions that ask users to download unfamiliar files, run computer commands or bypass security warnings. Those are not normal requirements for accessing legitimate medical information through MyChart.
The safest way to check a MyChart account is to avoid the link in the message altogether.
Patients should instead open the official MyChart application on their phone or tablet, or independently navigate to their healthcare provider’s established website and access the patient portal from there.
Experts also advise against replying to suspicious messages or providing passwords, verification codes, Social Security numbers, Medicare information, insurance details or financial information.
Anyone who believes they have entered information into a fraudulent MyChart website should immediately take steps to protect the account. That can include changing the compromised password through the legitimate MyChart portal and contacting the healthcare provider using a phone number or other contact information obtained independently of the suspicious message.
Patients should also consider whether the same password was used on other websites and change those passwords as appropriate.
The key warning from healthcare and cybersecurity officials is that criminals do not necessarily need to break into MyChart to obtain sensitive information. They can simply convince a patient to hand it over.
For anyone who receives an unexpected MyChart message, the safest approach is to stop, avoid clicking, and access the account directly through a trusted source.
And if the message promises a free Medicare kit, health package or other unsolicited reward, officials say that should be considered a major warning sign.
