Why Phishing Emails Are Still the #1 Way Medical Practices Get Breached

Hacking and IT incidents now account for more than 80% of large healthcare data breaches reported to HHS, and the entry point in the overwhelming majority of those cases is still the same: someone clicked a link in an email. Ascension Health's 2024 breach, one of the largest healthcare breaches on record, started with a single malicious phishing attachment opened by one employee. It's not a sophisticated hack. It's a convincing email and a busy front desk.

The numbers are worse than most practice owners assume. In phishing simulation tests, 88% of healthcare workers have clicked a phishing link at least once. Business email compromise attacks targeting healthcare organizations are up 473%, and the average healthcare organization now sees roughly 96 email fraud attempts every quarter. Your front desk and billing staff are specifically targeted because they have access to scheduling systems, insurance information, and patient portals, and they're trained to be helpful and responsive, which is exactly what a well-crafted phishing email exploits.

What actually stops this isn't a single tool. Email filtering that catches spoofed domains and malicious attachments before they land in an inbox is the first layer, but it's not enough on its own. Multi-factor authentication means a stolen password from a phishing page doesn't automatically hand over access to your systems. Regular, realistic phishing simulation training, not a once-a-year compliance video, teaches staff to spot the specific tactics being used against practices like yours right now. And a clear, no-blame reporting process matters just as much: staff need to feel safe flagging a suspicious email immediately rather than hoping it was nothing, because the difference between catching a phishing attempt in minute one and minute sixty can be the difference between a close call and a reportable breach.

If your practice hasn't run a phishing simulation in the last year, that's worth fixing before your next HIPAA risk assessment, not after an incident forces the conversation.

See how a phishing simulation and staff training program works for practices your size →