Deepfake Voice Phishing at a Sialendoscopy Center: An Incident Response Guide

A convincing voice is not proof of identity. In a sialendoscopy center, a caller using voice impersonation or caller ID spoofing may try to obtain protected health information (PHI), staff credentials, a one-time authentication code, a payment, or an unauthorized clinical action. Treat unexpected requests as unverified until staff confirm them through a trusted channel.

How should staff verify a suspicious call?

Do not rely on caller ID, a familiar voice, or details the caller knows. Caller ID can be spoofed, and AI-generated voices can sound like a real person. The Federal Trade Commission’s caller ID guidance and the FBI’s guidance on AI-generated voice messages recommend independently verifying callers rather than trusting the number or message they provide.

• Ask for the caller’s name, role, department, and reason for calling, then end the call if the request is unexpected or pressured.
• Call the person back using a number from the center’s directory, internal contact list, or another trusted source—not a number supplied by the caller or displayed on caller ID.
• For a claimed vendor, bank, or partner, contact the organization using an established number already on file.
• Verify that the person is authorized to request the information or action. Follow the center’s identity-check and escalation procedures.

What actions should staff stop until the caller is verified?

Pause before sharing information or changing anything. Do not disclose PHI, patient schedules, staff details, credentials, passwords, or one-time codes. Do not approve a password reset, change payment or bank details, initiate a transfer, install software, grant remote access, or alter a patient’s care based only on an unexpected call.

If the caller claims there is an emergency, follow the center’s established emergency or clinical escalation process rather than letting the caller bypass verification. A legitimate-sounding voice, urgent tone, or apparent knowledge of internal details does not establish authority.

How should a suspected voice phishing attempt be reported and escalated?

Report the call promptly through the center’s incident response protocol. Notify the supervisor or practice manager and the designated privacy, security, or compliance lead. If the caller requested credentials, system access, a payment, or a clinical change, alert the appropriate IT, finance, or clinical lead as well.

HIPAA’s Security Rule requires covered entities to have procedures for identifying and responding to suspected or known security incidents, mitigating harmful effects when practicable, and documenting incidents and outcomes. See HHS guidance on Security Incident Procedures. A suspicious call should be recorded and assessed under the center’s policy; it does not, by itself, mean that patient information was breached or that an external notification is automatically required.

What evidence should the center preserve?

Document what happened as soon as possible, using the center’s approved reporting channel. Record the date and time, the number shown, the caller’s claimed identity, the request, any callback number, what staff said or did, and when the call ended. Preserve relevant voicemail, messages, call logs, payment records, and system alerts or access logs.

Keep original messages and records intact; do not delete, edit, or forward sensitive material to personal accounts. Limit access to staff handling the investigation and follow the center’s evidence-handling procedures. HHS identifies preserving evidence, documenting incidents, and recording outcomes as possible parts of security incident response; its HIPAA Security Series on Administrative Safeguards discusses these practices. Do not record calls unless the center has confirmed that doing so is lawful and consistent with its policy.

What steps should follow a credential, access, or payment disclosure?

Tell the security or IT lead immediately if a password, one-time code, or other access information was shared. From a trusted device and through the center’s approved process, change or revoke affected credentials, invalidate active sessions where possible, and review whether authentication factors or account recovery details were changed. The security team should assess affected accounts and connected systems, including email, scheduling, and electronic health record access.

Conduct an account activity review for unusual logins, access to patient records, downloads, forwarding rules, new devices, or changes to permissions. Preserve relevant logs before routine retention limits remove them. HHS’s HIPAA ransomware guidance describes incident analysis and mitigation, including password resets and use of multifactor authentication; the center’s security team should select steps appropriate to the accounts and systems involved.

If a payment or payment instruction was disclosed or initiated, notify the center’s finance lead and contact the bank, card issuer, or payment processor immediately using a trusted number. Ask whether the transaction can be stopped or disputed, and secure any affected payment account. Follow the center’s policy for notifying law enforcement or making a fraud report.

How should the center assess potential patient privacy exposure?

The privacy or compliance lead should determine whether PHI was actually disclosed, accessed, or acquired without authorization. Identify what information was involved, whose records may have been affected, which systems or accounts were exposed, who received the information, whether it was viewed or retained, and what steps limited further access.

Under HHS’s Breach Notification Rule guidance, an impermissible use or disclosure of PHI is generally presumed to be a breach unless the covered entity or business associate demonstrates a low probability that the PHI was compromised through a risk assessment. The assessment considers the nature and extent of the PHI, the recipient, whether the information was actually acquired or viewed, and the extent of mitigation. The privacy lead should document the determination and consult counsel as appropriate, including about any applicable state-law or contractual requirements.

How should staff verify phone-based clinical instructions?

Do not act on an unexpected medication, procedure, or other clinical instruction until you confirm the caller’s identity and authority through a trusted contact route, such as the clinician’s established number or the center’s approved directory. If the instruction appears urgent, escalate it to the responsible licensed clinician and follow the center’s emergency procedures.

For an authorized telephone order, follow center policy: document the complete instruction in the approved record, read it back to the caller, and obtain confirmation before proceeding. AHRQ’s TeamSTEPPS Check-Back tool describes recording and reading back a telephone order to confirm it was heard and transcribed correctly.

In short, pause, verify independently, report promptly, preserve evidence, and assess any possible exposure before deciding what further action is required.

FAQs.

Does a suspicious call alone mean patient information was breached?

No. A suspicious call is a potential security incident to document and assess; it does not alone establish that PHI was accessed or disclosed. The center should investigate what information, if any, was shared or accessed and have its privacy lead assess whether HIPAA breach-notification requirements apply.

What should staff do if they shared a one-time code?

Notify the security or IT lead immediately and provide the account involved, the time, and the code-sharing circumstances. Follow instructions to secure the account, revoke access or sessions, and review account activity. If the code related to a bank or payment account, contact that institution through a trusted number as well.

Who should be notified if a payment was initiated?

Notify the supervisor and finance lead, then contact the bank, card issuer, or payment processor using a trusted number or official app to ask about stopping or disputing the transaction. Follow the center’s fraud-reporting and law-enforcement procedures.

How should staff verify a medication instruction received by phone?

Call the clinician back using an established number or directory, confirm the clinician is authorized, and follow the center’s policy for telephone orders. Document the instruction, read it back for confirmation, and escalate any uncertainty to the responsible licensed clinician before acting.