Phishing Incident Response Checklist for Physician Offices and Laboratories

How should staff report and preserve a suspected phishing email?

Report suspicious messages promptly—even if you only opened the email or are unsure whether you interacted with it. Use your organization’s phishing-report button or approved security channel. If you cannot access it, call the designated IT or security contact using a known number. Do not reply, click links, open attachments, or forward the message to coworkers. CISA’s phishing guidance recommends reporting suspicious messages to the appropriate security team and avoiding internal forwarding.

• Keep the original message in your mailbox unless your approved reporting process removes or quarantines it.
• Tell the response team when it arrived, who received it, and whether anyone clicked a link, opened an attachment, entered information, or approved an MFA prompt.
• Ask IT to preserve the original message and its email authentication headers for investigation. Do not try to inspect attachments or copy PHI into an unapproved reporting channel.
• If you already clicked, opened, or replied, report that too. Prompt, accurate reporting helps the response team check whether the message reached other staff.

Preserving the message does not mean leaving a threat active: the security team can quarantine it or remove matching copies after capturing what it needs to investigate.

Which accounts and devices should be contained first?

Contain the accounts and endpoints tied to the interaction, then expand the response based on what the evidence shows. Prioritize the affected work email and identity account, followed by connected single sign-on, VPN or remote-access accounts, EHR, laboratory information system (LIS), cloud storage, and any privileged accounts the user can access.

• If credentials were entered: Contact IT immediately. From a clean, trusted device, reset the affected password and any reused passwords. Have an administrator revoke active sessions and tokens, check MFA methods and recovery settings, and review mailbox forwarding rules and connected applications.
• If a link or attachment was opened: Tell IT which device was involved and what happened. IT should isolate a potentially affected workstation using its incident procedures; do not use it to access patient systems while it is being assessed.
• If an account may have been taken over: Review recent sign-ins, account changes, unusual messages, and access to connected systems. CISA, NSA, FBI, and MS-ISAC recommend re-provisioning suspected or confirmed compromised accounts, auditing account access, and isolating affected workstations as appropriate. CISA’s phishing response guidance describes these incident-response steps.

Use targeted containment and coordinate with clinical or laboratory leadership before disabling shared systems or access needed for urgent care. Staff should not make unsupervised changes to clinical equipment, network connections, or system configurations.

How can you assess whether patient information or clinical systems were affected?

Build a timeline from the message delivery through containment. Determine who received it, who interacted with it, which accounts and devices were involved, and whether the activity stopped or continued. Review available email, sign-in, endpoint, EHR, LIS, VPN, and cloud audit records for unusual access or changes. HHS recommends scoping affected systems, determining whether an incident is ongoing, and examining how it occurred as part of incident response. HHS guidance on responding to security incidents explains these investigation steps.

• Check whether the attacker accessed email, viewed or downloaded attachments, searched mailboxes, created forwarding rules, sent messages, or used shared files.
• Review EHR and LIS access for unusual logins, searches, exports, altered records, changed orders, or access outside the user’s usual role or working pattern.
• Identify the types and amount of protected health information (PHI) potentially involved, including whether patient identifiers, diagnoses, test results, or other sensitive details were exposed.
• Assess whether clinical systems, data integrity, result delivery, or availability were disrupted, and whether suspicious activity affected more than one user or system.

A successful phishing interaction does not by itself establish exactly what PHI was accessed. Use available evidence to establish what was accessible, whether it was actually viewed or acquired, and what mitigation followed. Those findings also support any later HIPAA breach assessment.

How can physician offices and laboratories protect patient care during containment?

Tell clinical and laboratory leaders early if containment could interrupt scheduling, prescribing, orders, result delivery, or access to records. Activate your organization’s clinical downtime procedures when needed, and use only approved, access-controlled alternatives for patient information. The ONC’s Health IT Playbook recommends a prepared paper-based process for documenting care and orders when an EHR is unavailable; its SAFER Guides include recommendations for EHR contingency planning and safe test-result workflows.

• Keep patient identification, medication and test orders, urgent communications, and follow-up responsibilities clear during downtime.
• Use verified contact information and approved channels to communicate with clinicians, patients, and partner laboratories. Do not rely on a potentially compromised email account.
• For laboratories, track specimens, pending results, corrected results, and results already released using an approved downtime log. Route critical results through a verified process and document who received them.
• When systems return, reconcile downtime records and results against the restored EHR or LIS. Assign responsibility for checking for duplicate, missing, delayed, or misfiled entries; document follow-up for unresolved items.

Safety takes priority: the incident lead and clinical or laboratory leadership should balance containment with continuity, using established procedures rather than improvising a new workflow during the event.

What evidence and response actions should be documented?

Maintain one incident record with a clear timeline and named owners for response tasks. HIPAA’s Security Rule administrative safeguards require covered entities to identify and respond to suspected or known security incidents, mitigate harmful effects where practicable, and document incidents and outcomes. HHS guidance on Security Rule administrative safeguards describes these response and documentation duties.

• Record when the message was reported, what the employee did, which users and systems were involved, and when containment actions occurred.
• Preserve the original email, headers, relevant sign-in and audit logs, endpoint alerts, message traces, and system changes through approved methods. Limit access to evidence and record who collected or handled it.
• Document the containment and recovery actions, including password resets, session revocation, account restrictions, device isolation, vendor support, and restoration or reconciliation work.
• Record what is known and unknown about PHI access, system impact, patient-care disruption, and any analysis used to reach conclusions.
• Track decisions, approvals, notifications, and follow-up actions, including unresolved risks and lessons for improving the response plan.

When should the incident be escalated and notification obligations assessed?

Escalate promptly to the designated security and privacy officials when a user may have submitted credentials, opened a suspicious attachment, approved an unexpected MFA request, or exposed PHI. Involve clinical or laboratory leadership if patient care, test workflows, or system integrity may be affected. Notify relevant vendors or business associates according to your agreements and incident procedures, and involve legal counsel when assessing regulatory or contractual duties.

A phishing event is a security incident; it is not automatically a reportable HIPAA breach. If there may have been an impermissible use or disclosure of unsecured PHI, the covered entity or business associate must assess the facts under the HIPAA Breach Notification Rule. HHS describes a risk assessment that considers the type and extent of PHI, who received or used it, whether it was actually acquired or viewed, and how much the risk was mitigated. Document the assessment and its conclusion. HHS’s Breach Notification Rule guidance explains the factors and documentation expectations.

If notification is required, covered entities must notify affected individuals and HHS, and in certain circumstances the media. Individual notice is due without unreasonable delay and no later than 60 days after discovery; that is an outside limit, not a target for delaying action. Business associates must notify the covered entity without unreasonable delay and no later than 60 days after discovery, though agreements may set a shorter reporting deadline. Confirm the applicable obligations and timelines with your privacy officer and counsel. HHS’s notification requirements distinguish these duties and explain the thresholds.

In short, report quickly, preserve evidence, contain affected access, protect patient-care workflows, document decisions, and escalate early so the organization can assess PHI exposure and notification duties on the facts.

FAQs

Should staff delete a suspected phishing email?

No. Report it through your approved security channel and leave the original available unless that reporting process quarantines or removes it. Do not forward it to coworkers or interact with its links or attachments. IT can preserve the necessary message details and remove other copies safely.

What should an employee do after entering credentials into a phishing link?

Contact IT or security immediately and say which account and information were entered, whether an MFA code or approval was involved, and when it happened. Do not continue using a device that may be affected. From a clean, trusted device, follow IT’s instructions to reset the affected password; administrators should revoke active sessions and check account settings and activity.

How can a laboratory maintain safe result workflows during a phishing incident?

Follow the laboratory’s downtime procedures, keep a controlled log of specimens and pending or released results, and route critical results through verified channels. Assign staff to reconcile downtime records against the LIS after service is restored, checking for missing, duplicate, delayed, or misfiled results and documenting follow-up.

When should a phishing incident trigger a HIPAA breach assessment?

Escalate for assessment whenever the facts suggest PHI may have been accessed, acquired, used, or disclosed impermissibly—for example, if an attacker may have used compromised credentials to access an email account, EHR, LIS, or files containing PHI. A phishing report alone does not establish a reportable breach; the organization must evaluate the available evidence and document its decision under the HIPAA Breach Notification Rule.