Phishing Incident Response Guide for Shared Care Coordination Databases

How should you contain a suspected phishing compromise?

Act promptly, but avoid actions that could destroy evidence or interrupt care unnecessarily. Notify your organization’s security or IT team through its approved incident-reporting channel, and follow the incident response plan. HIPAA’s Security Rule requires covered entities to identify and respond to suspected or known security incidents, mitigate harmful effects where practicable, and document incidents and their outcomes. HHS Security Rule guidance on security incident procedures.

• If someone entered a password or approved an unexpected sign-in request, tell the security team immediately. From a trusted device, follow its instructions to change the affected password, revoke active sessions, and review or remove unauthorized recovery methods and connected applications.
• If a link opened a file or triggered a download, report that detail and the device involved. If instructed by IT, disconnect the device from networks while leaving it powered on so responders can assess it.
• Contain the message: ask the email administrator to remove matching messages from other inboxes and block malicious senders or links where appropriate. Do not reply to the message or forward it broadly.
• Protect the shared database: temporarily suspend or restrict an affected account when needed, and revoke suspicious access tokens, app passwords, or integrations. Coordinate changes with administrators to avoid disrupting essential care workflows.
• Preserve evidence: retain the original message, headers if available, relevant alerts, and a timeline of actions. Do not delete records or reset devices unless responders direct you to.

Treat a suspected compromise as a security incident even if you do not yet know whether anyone accessed patient information. The response team can decide the scope of containment as evidence develops.

Which accounts and shared data should you check for exposure?

Start with the account used to interact with the phishing message, then follow its access paths. A compromised email or single sign-on account can expose connected systems even when the attacker never directly enters the care coordination database.

• Identity and communications: review the user’s email, single sign-on or identity provider, password-reset methods, multifactor authentication settings, delegated access, and any suspicious inbox rules or forwarding changes.
• Connected systems: check the shared care coordination database, electronic health record, cloud file storage, virtual private network, remote access tools, mobile applications, and third-party integrations the account could reach.
• Privileged access: investigate administrator accounts, service accounts, and accounts able to export records, manage users, change permissions, or configure integrations. Prioritize privileged account monitoring because those accounts may reach more data or change security settings.
• Shared account security: identify shared logins, shared mailboxes, group permissions, and team accounts that could have been affected. Where a shared credential was exposed, determine who used it and rotate it safely; avoid relying on one common login to establish individual accountability.

Use authentication log review to look for unusual sign-ins, such as unfamiliar devices or locations, unexpected times, repeated failures, unfamiliar multifactor prompts, and new sessions after the user reported the incident. Review application audit logs for records viewed, searched, changed, downloaded, printed, exported, or shared, as well as new users, permission changes, and API activity.

HIPAA requires audit controls for systems that contain or use electronic protected health information and regular review of information-system activity records. The precise logs available vary by system, so ask each system administrator or vendor what can be retrieved and how long it is retained. HHS HIPAA Audit Protocol on audit controls and activity review.

Record the time period reviewed, the systems checked, the identities involved, and what the logs do and do not show. A lack of recorded access is useful evidence, but it does not by itself prove that information could not have been exposed if the system’s logs are incomplete or unavailable.

How can care teams coordinate safely during an incident?

Set a clear point of contact—typically the incident lead or designated security, privacy, or operations staff member—and use a communication channel the response team has confirmed is not affected. If email or a shared account may be compromised, use approved alternatives such as verified phone numbers, an unaffected secure messaging service, or established downtime procedures.

Share only the information colleagues need to maintain care and respond to the incident. Avoid putting patient names, diagnoses, or other protected health information in broad staff alerts or unapproved personal email, text, or messaging accounts. Verify urgent instructions using a known directory or number rather than contact details in the suspicious message.

Agree on practical steps for care continuity: who can access unaffected systems, how urgent referrals and handoffs will be documented, and how delayed entries will be reconciled once normal operations resume. If a database or account must be restricted, tell affected teams how to reach the designated coordinator without sharing compromised credentials.

Keep a shared incident record in an approved, access-controlled location. Include a timeline, decisions, responsible people, affected systems, containment steps, and outstanding questions. Follow your organization’s incident procedures for reporting and documentation. HHS guidance on security incident response, documentation, and business associate reporting.

When should you report the incident and assess breach notification duties?

Report a suspected phishing compromise through your organization’s internal process as soon as possible, even if there is no confirmed protected health information exposure. A security incident and a reportable breach are not the same thing: the incident should be assessed, but a phishing email alone does not automatically mean that a breach occurred.

If an impermissible use or disclosure of protected health information may have occurred, the covered entity or business associate must assess whether the information was unsecured and whether an exception applies. Under the HIPAA Breach Notification Rule, an impermissible use or disclosure is generally presumed to be a breach unless the organization demonstrates a low probability that the PHI was compromised through a risk assessment. That assessment considers the nature and extent of the information, who received or used it, whether it was actually acquired or viewed, and how the risk was mitigated. HHS Breach Notification Rule and risk-assessment guidance.

Involve the privacy officer, security lead, legal counsel, and other designated decision-makers. Document the evidence, the assessment, and the reasons for the decision. Consider applicable state laws, contracts, and business associate agreement (BAA) deadlines as well as HIPAA. A business associate must report a breach of unsecured PHI to the covered entity; the BAA may also set reporting requirements for security incidents that do not rise to the level of a breach. HHS guidance on business associate incident reporting.

When HIPAA breach notification is required, covered entities generally must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery; other notice duties depend on the number of people affected and the circumstances. The 60-day limit is an outer deadline, not a reason to postpone action. HHS notification requirements.

How should you alert staff to an active phishing threat?

Use a trusted internal channel that is not affected by the suspected compromise. Keep the alert specific and actionable: identify the subject line, sender address, link, or attachment if known; say not to click, reply, or open it; and explain how staff should report it. If anyone interacted with the message, direct them to contact the designated security team immediately.

Do not include live malicious links or unnecessary patient information in a general alert. If staff need to help identify the message, provide safe indicators or a screenshot with sensitive details removed. Ask staff not to forward the message unless the security team specifically requests it, since forwarding can expose others or alter useful evidence.

For suspicious messages, CISA advises users not to reply or click links or attachments, and to report messages that impersonate a trusted organization through a verified contact channel. CISA phishing tip sheet.

What account security measures reduce repeat incidents?

Use individual accounts wherever possible so each person’s access can be limited and reviewed. Assign permissions according to job responsibilities, remove access that is no longer needed, and review elevated privileges and service accounts. If a shared credential is unavoidable for a specific workflow, restrict access to it, protect it in an approved credential manager, rotate it when exposed, and monitor its use.

Enable multifactor authentication for email, remote access, and systems containing shared care data. Where supported, prioritize phishing-resistant multifactor authentication, such as FIDO-based security keys or passkeys. CISA recommends phishing-resistant MFA, particularly for email, VPNs, and accounts that access critical systems. CISA guidance on phishing-resistant MFA and account security.

Maintain audit logs and review them for unusual sign-ins, privilege changes, and unexpected access to or exports of shared records. Also use secure recovery procedures, timely software updates, and staff training that explains how to recognize and promptly report phishing attempts. Test incident procedures so staff know how to preserve care coordination if a system or account must be restricted.

Strong access controls, reliable authentication log review, and clear incident documentation help your team contain attacks while protecting patient information and keeping essential coordination moving.

FAQs.

What should staff do after clicking a suspected phishing link?

Report it to the organization’s security or IT team immediately, including whether you entered credentials, approved a sign-in prompt, opened an attachment, or downloaded a file. Follow instructions to secure the account or device; do not reply to the sender, delete potential evidence, or use a possibly compromised account to send warnings.

How can care teams coordinate if email or shared accounts may be compromised?

Switch to an approved communication channel that responders have confirmed is unaffected, such as verified phone contacts or an established secure messaging service. Follow downtime procedures, share only the information needed for care, and avoid personal accounts or unapproved tools for patient information.

Which logs can help determine whether a shared database was accessed?

Review identity-provider and application sign-in logs, multifactor events, database audit trails, and records of searches, views, changes, downloads, exports, sharing, API calls, and permission changes. Compare activity with the affected user’s normal patterns and preserve the logs, along with the time period reviewed and any limitations.

When might a phishing incident require breach notification?

Notification may be required if an impermissible use or disclosure of unsecured PHI occurred and the organization cannot demonstrate a low probability that the PHI was compromised through the required risk assessment, or if no applicable exception applies. The covered entity or business associate should promptly involve its privacy and security decision-makers and follow HIPAA, applicable state law, and contractual requirements. HHS Breach Notification Rule guidance.