Deepfake Voice Call to a Pharmacy Refill Hotline: Incident Response Checklist

A convincing voice on a refill hotline is not proof that the caller is the patient or an authorized prescriber. If a call seems suspicious, pause the refill, verify the request through a separate trusted channel, and follow your pharmacy’s incident-response procedures. This checklist covers immediate actions, patient identity verification, evidence preservation, and escalation.

How to recognize and verify a suspected deepfake refill call

Voice cloning can make an unfamiliar caller sound like someone you know, and a call may not contain reliable signs that it is synthetic. Treat unusual requests as reasons to verify—not as proof that a voice is fake. A caller’s urgency, insistence on bypassing normal steps, or request to change account or delivery details can also warrant extra scrutiny.

• Be cautious if the caller asks you to ignore normal prescription refill authorization procedures, disclose information unnecessarily, or make an unusual change to a patient’s profile.
• Do not rely on a familiar voice, a caller ID display, or a voice biometric authentication result as the only proof of identity. Caller ID can be manipulated, and the FBI advises independently verifying a caller using a phone number obtained from a trusted source. FBI guidance on impersonation and voice cloning; FCC guidance on caller ID spoofing.
• Look for inconsistencies in the request, such as conflicting patient details, an unexpected prescriber, a different callback number, or pressure to skip a required review. These are warning signs, not a reliable test for detecting deepfake audio.

End the call politely if needed. Then verify the caller’s identity using an established number or channel already in your pharmacy records—not contact details supplied during the suspicious call. Record the request as unverified until the appropriate checks are complete.

What to do immediately during or after a suspicious call

Pause the refill and any requested profile, payment, address, or delivery changes while you verify the request. Do not disclose additional patient information or confirm account details just because the caller already knows some of them.

1. Follow the pharmacy’s process for flagging a suspicious call and notify the pharmacist on duty or designated supervisor.
2. Record the time, hotline or extension used, displayed caller ID, callback number offered by the caller, and the request made. Note what information, if any, was disclosed and whether a system action occurred.
3. If the caller is still on the line, avoid confrontation or making accusations. Ask for a safe way to reconnect, end the call, and use a trusted contact method to verify the request.
4. If staff disclosed protected health information (PHI), changed a record, authorized a refill, or shared credentials, report that promptly through the pharmacy’s security or privacy incident process.

HIPAA requires covered entities to identify and respond to suspected or known security incidents, mitigate harmful effects to the extent practicable, and document incidents and outcomes. HHS guidance on HIPAA security incident procedures.

How to secure patient accounts and pharmacy systems

If the call may have resulted in unauthorized access or a system change, contact your pharmacy’s security or IT lead promptly. Ask them to review the affected accounts and systems using the organization’s response procedures.

• Review pharmacy management system access logs for unusual sign-ins, prescription changes, profile edits, or access outside the expected time or user pattern.
• Preserve relevant logs before routine retention or system processes remove them. Ask authorized IT staff to secure suspicious accounts, end active sessions, and reset credentials where indicated.
• Check whether patient contact information, authorized representatives, prescriber details, refill status, or delivery instructions were altered. Correct changes only through approved procedures, keeping a record of what was changed and by whom.
• Limit access to staff who need it for the response, and do not share passwords or use another employee’s account to investigate.

HIPAA’s Security Rule includes access control and audit control standards for systems containing electronic PHI. HHS describes audit controls as mechanisms that record and examine activity in those systems. HHS HIPAA audit protocol.

How to verify refill requests with patients and prescribers

Use an independent verification path already on file. For a patient request, call the documented number or use an established patient portal or other approved channel. Do not use a new number, link, or contact method provided only by the caller.

Follow your pharmacy’s patient identity verification procedure, using the minimum information needed to confirm the request. Verify the medication, prescription status, requested change, and any account or delivery updates before acting. A familiar voice or voice biometric authentication should not replace the pharmacy’s identity-verification process.

If the request requires prescriber confirmation, contact the prescriber’s office using a number from a trusted directory or existing pharmacy record. Do not use a number supplied by the suspicious caller without independently confirming it. Document who confirmed the request, the channel used, and the result.

Apply the usual prescription rules as well as your organization’s procedures; a caller’s request does not itself authorize a refill. Controlled substances have additional federal requirements—for example, DEA guidance states that Schedule II prescriptions may not be refilled, while Schedule III and IV prescriptions may have limited refills when authorized by the practitioner. State law and other applicable requirements may also affect dispensing. DEA resource guide on controlled-substance prescriptions and refills.

What to document and preserve for investigation

Create a clear, factual incident record as soon as practical. Separate what staff directly observed from what they suspect; do not label a call a confirmed deepfake unless that has been established through an appropriate investigation.

• Date and time of the call, hotline or extension reached, displayed caller ID, and any number the caller gave for a callback.
• The caller’s stated identity and requested action, along with relevant wording, unusual pressure, or deviations from normal procedure.
• What staff disclosed or did, whether a refill or account change was processed, and which patient or system records may have been affected.
• Verification attempts, the trusted contact information used, the person reached, the result, and any steps taken to contain or correct changes.
• Potentially relevant call recordings, voicemail, messages, system audit records, and related internal reports, handled according to your organization’s retention and privacy procedures.

Preserve original records where possible, restrict access to evidence to authorized personnel, and follow your organization’s process for maintaining incident evidence. The HIPAA Security Rule requires documentation of security incidents and their outcomes; if PHI may have been involved, include the information needed for a protected health information breach assessment. HHS security incident procedures guidance.

When to notify pharmacy leadership and law enforcement

Notify the pharmacist in charge, pharmacy leadership, and the designated privacy or security contact promptly if the caller may have obtained PHI, triggered an unauthorized system action, changed a patient record, or succeeded in securing a refill. Escalate even if the request was stopped, so the organization can assess whether follow-up is needed.

A suspicious call alone does not automatically mean that a reportable HIPAA breach occurred. If an impermissible use or disclosure of unsecured PHI is identified, the covered entity must assess the circumstances under the Breach Notification Rule and determine whether notification is required. If a breach is reportable, federal deadlines apply: individual notice is due without unreasonable delay and no later than 60 days after discovery; HHS reporting timelines differ depending on whether 500 or more individuals are affected. HHS Breach Notification Rule guidance.

Ask your privacy or compliance lead to determine whether regulators, a state pharmacy board, or other authorities must be notified under applicable law and organizational policy. A pharmacy may contact local law enforcement or submit a report to the FBI’s Internet Crime Complaint Center when the facts suggest fraud or another crime. Share PHI only as permitted or required by law; HIPAA permits law-enforcement disclosures only in specified circumstances and subject to applicable conditions. HHS guidance on disclosures to law enforcement; FBI Internet Crime Complaint Center.

How to prevent repeat voice impersonation attacks

Make independent verification a routine part of refill hotline workflows, especially for unusual requests or changes to patient accounts. Provide staff with a clear escalation route and practice the steps they should follow when they cannot verify a caller.

• Use documented patient identity verification procedures and a separate trusted channel for callbacks. Do not treat caller ID or voice recognition alone as proof of identity.
• Train hotline staff to pause suspicious requests, minimize disclosure, document the call, and report possible incidents promptly.
• Review pharmacy management system access logs and incident reports for patterns that may indicate repeated targeting or unauthorized changes.
• Periodically test the incident-response process, including how staff preserve evidence and reach pharmacy leadership, privacy, security, and IT contacts.
• Review the procedure after an incident and update it when the investigation identifies gaps or lessons learned.

The essential response is consistent: pause unverified refill activity, verify through a separate trusted channel, secure affected accounts, preserve evidence, and escalate for a documented breach assessment when PHI may be involved.

FAQs

What should pharmacy staff do if a refill hotline receives a suspected deepfake call?

Pause the refill and any requested account changes, avoid disclosing more information, and notify the pharmacist or supervisor. Verify the request through a trusted contact method already on file, then document the call and report any possible disclosure or system action through the pharmacy’s incident process.

How can staff verify a refill request without relying on the caller’s voice?

Use the pharmacy’s patient identity verification procedure and contact the patient through a documented phone number, established patient portal, or another approved channel. If prescriber confirmation is needed, call the office using independently verified contact information rather than a number supplied only by the caller.

What information should be documented after a suspected voice impersonation incident?

Record the call’s date and time, hotline or extension, displayed caller ID, caller-provided callback number, request, actions taken, information disclosed, and any patient or system records involved. Also document verification attempts, outcomes, response steps, and evidence preserved.

When should a pharmacy report a suspected deepfake call to regulators or law enforcement?

Escalate the incident internally as soon as possible. The privacy or compliance lead should assess whether PHI was impermissibly accessed or disclosed and whether a reportable breach or other notification obligation exists under applicable federal and state requirements. Consider law-enforcement reporting when the facts suggest fraud or another crime, and disclose PHI only as permitted or required by law.