QR Code Phishing Incident Response Checklist for Autoinflammatory Disease Clinics

A QR code can look like an ordinary sign-in shortcut, appointment notice, or vendor instruction. But a malicious code can lead to a fake login page or a harmful download, turning a routine clinic workflow into a QR code attack vector.

Use this checklist to report suspected activity quickly, protect clinic systems and patient care, and determine whether protected health information (PHI) may have been exposed. Follow your clinic’s incident-response plan and involve its designated security and privacy leads.

How can staff recognize QR code phishing in clinic workflows?

QR code phishing, sometimes called “quishing,” hides a link inside a scannable image. In a clinic, a code might appear in an unexpected email, text, printed notice, delivery, or message that claims staff must urgently verify an account, review a document, or resolve a system problem. The linked page may imitate a trusted sign-in screen and attempt credential harvesting, or prompt a download that could compromise a device. The FTC’s QR-code scam guidance describes fake websites and malware as possible outcomes.

• Be cautious of unexpected codes, urgent demands, unfamiliar senders, or instructions to enter a clinic username, password, or multifactor authentication code.
• Check the URL preview before opening it. Watch for misspellings, lookalike domains, and addresses that do not match the clinic’s known service.
• Look for a sticker or other sign that a code posted at the clinic may have been covered or replaced.
• Verify the request through a known phone number or trusted internal channel—not contact information supplied with the suspicious code.
• Report the message or code even if you did not scan it, so the clinic can check whether others received or encountered it.

What should staff do immediately after scanning a suspicious QR code?

Stop interacting with the page. Do not enter more information, approve a login prompt, download a file, install an app, or grant permissions. Report the event promptly to the clinic’s IT or security contact, even if the page appeared blank or nothing obvious happened.

• Tell IT what happened and when: whether you scanned the code, opened the link, entered credentials, approved a multifactor prompt, downloaded anything, or granted device permissions.
• Preserve the original message, email, printed notice, or code if you can do so safely. Do not forward it broadly or send it from a potentially affected account.
• If you entered a clinic password, notify IT immediately. From a separate, trusted device, change the password through the clinic’s verified sign-in page. If you reused that password elsewhere, change it there too.
• Ask IT to assess whether to reset authentication factors and perform identity provider session revocation—ending active sign-in sessions that might otherwise remain open after a password change.
• If you downloaded or installed something, approved a profile or app, or notice unexpected device behavior, stop using the device for clinic work and follow IT’s instructions.

A scan alone does not prove that a device was infected or that PHI was accessed. However, a QR code may lead to a spoofed site or a malicious download, so report what occurred and let the response team assess the risk. The FTC recommends checking unexpected QR-code links and avoiding rushed requests.

How should clinic devices and accounts be contained and secured?

Containment should match what happened and the device’s role. Ask IT or the incident-response lead to decide whether to isolate the device from the network, disable a compromised account, or take other action. Endpoint isolation can help limit further access, but staff should not improvise steps that could disrupt clinical operations or destroy useful evidence.

• Keep a potentially affected device available for IT. Do not wipe it, uninstall suspicious software, clear browser history, or power it off unless responders instruct you to do so.
• IT should use approved endpoint-management or security tools to isolate a device when warranted, and document the action and time taken.
• Secure accounts that may have been exposed. Depending on the investigation, responders may reset passwords, revoke active sessions and tokens, review multifactor settings, or temporarily disable access.
• Check whether the same credentials were used for email, the electronic health record (EHR), scheduling, prescribing, remote access, or other clinic services.
• Consider clinical continuity before restricting access. If isolation or account changes could affect patient care, coordinate a safe alternative workflow with clinical leadership.

HIPAA’s Security Rule requires covered entities and business associates to identify and respond to suspected or known security incidents, mitigate harmful effects to the extent practicable, and document incidents and outcomes. See HHS guidance on security-incident response and reporting.

How should the clinic investigate possible exposure of patient or clinical data?

The clinic’s security, privacy, and technical responders should establish what the QR code led to, which accounts or devices were involved, and whether anyone accessed, viewed, changed, or transmitted clinic information. The investigation should include relevant clinical system access logs and identity-provider, email, network, and endpoint records, as available.

• Identify the affected person, device, account, time range, URL, and systems involved. Check whether other staff members received the same message or scanned a related code.
• Review sign-in activity for unfamiliar locations or devices, unexpected multifactor prompts, unusual session activity, and access outside the person’s normal role or work pattern.
• Review EHR and other clinical-system activity for records viewed, exported, changed, or accessed in unusual ways. Determine whether patient information, including identifiers or diagnoses, was involved.
• Assess whether an attacker could have accessed email, shared files, appointment systems, or other sources of PHI even if the EHR log shows no unusual activity.
• Preserve relevant messages, URLs, screenshots, timestamps, endpoint alerts, and log exports. Restrict access to investigation materials and record who collected them and when.

For a HIPAA protected health information breach assessment, an impermissible use or disclosure of PHI is generally presumed to be a breach unless the clinic demonstrates a low probability that PHI was compromised through a risk assessment. HHS identifies the nature and extent of the PHI, who received or used it, whether it was actually acquired or viewed, and the extent of mitigation as factors to consider. See the HHS Breach Notification Rule guidance.

Who should the clinic notify and when?

Staff should notify the clinic’s designated IT or security contact and privacy or security officer as soon as possible under the clinic’s incident-reporting procedure. Escalate promptly if credentials were entered, a device downloaded or installed something, a login was approved unexpectedly, clinical systems show suspicious activity, or patient care may be affected.

• Involve clinic leadership and the relevant clinical lead when containment could interrupt care or affect access to time-sensitive treatment information.
• Contact vendors or service providers that may hold or manage affected clinic data, following the applicable business associate agreement and the clinic’s response plan.
• Have the privacy officer and legal counsel assess whether the incident involves a reportable breach and whether state law, contracts, or other requirements impose additional obligations.
• Do not notify patients, regulators, or the media based solely on a suspicious scan. The clinic should make those decisions through its authorized breach-response process.

If the clinic determines that unsecured PHI was breached, HIPAA generally requires individual notifications without unreasonable delay and no later than 60 calendar days after discovery. HHS notification is due without unreasonable delay and within 60 days for breaches affecting 500 or more individuals; breaches affecting fewer than 500 may be reported to HHS annually, within 60 days after the calendar year ends. Additional media notice applies in certain cases affecting more than 500 residents of a state or jurisdiction. Confirm the applicable requirements with the privacy officer and counsel using the current HHS guidance.

How can the clinic document the incident and restore safe operations?

Maintain an incident record that captures the timeline, decisions, people notified, affected accounts and devices, containment actions, investigation results, and recovery steps. Preserve evidence in a controlled way; avoid deleting suspicious messages or changing a device before responders can assess whether those actions could remove useful information. NIST’s current incident-response guidance, SP 800-61 Rev. 3, emphasizes incorporating response, recovery, and improvement into cybersecurity risk management.

• Record what staff observed and did, using clear times and facts. Separate confirmed findings from possibilities that remain under investigation.
• Retain incident evidence, such as the original QR-code message, URL, relevant system logs, endpoint alerts, and records of collection or transfer. Follow the clinic’s retention and access policies.
• Before restoring a device or account, have IT verify its security, remove unauthorized access or software as appropriate, and confirm that credentials and sessions are secured.
• Restore access in a controlled manner and monitor affected accounts and systems for suspicious activity.
• Use approved downtime or emergency-mode procedures if a response action interrupts clinical systems. Confirm that staff can access essential information safely and know how to return to normal workflows.
• After recovery, review what happened and update staff guidance, reporting steps, QR-code practices, or technical controls where needed.

What incident-response limitations should clinics consider?

This checklist supports initial response; it does not replace the clinic’s incident-response plan, technical investigation, or legal advice. A suspicious scan does not by itself establish malware, unauthorized access, or a reportable PHI breach. Conversely, a lack of obvious device symptoms does not establish that an account or data were safe.

Investigators may have incomplete logs, limited visibility into personal mobile devices, or uncertainty about whether information was actually viewed. Containment choices can also affect patient care and evidence, so clinic leadership and technical responders should coordinate. HIPAA’s breach-notification deadlines apply to a breach of unsecured PHI, not automatically to every suspected QR-code incident; state laws, contracts, and other obligations may differ.

In short, report early, secure affected accounts and devices with IT’s guidance, preserve evidence, assess possible PHI exposure, and resume clinical operations through approved procedures.

FAQs

What should staff do if they entered clinic credentials after scanning a QR code?

Notify IT or the security contact immediately. From a separate, trusted device, change the password through the clinic’s verified sign-in page, and report any multifactor prompts or approvals. Ask IT to review sign-in activity, revoke active sessions if appropriate, and secure any other accounts where the same password was used.

Should a device that scanned a suspicious QR code be disconnected from the network?

Not automatically in every case. Contact IT promptly and follow its instructions. If the device downloaded or installed something, showed unusual behavior, or may have exposed clinic access, IT may isolate it. Do not wipe, reset, or power it off unless responders direct you to do so.

How should a clinic assess whether patient information was exposed?

Review relevant identity-provider, email, endpoint, and clinical system access logs; identify what accounts and systems the user could reach; and determine whether PHI was accessed, viewed, changed, or transmitted. The privacy officer should document the HIPAA risk assessment using the factors in the HHS Breach Notification Rule guidance.

When should a clinic escalate a suspected QR code phishing incident?

Report it promptly under the clinic’s incident procedure. Escalate immediately if credentials or multifactor codes were entered, an app or file was downloaded, device permissions were granted, clinical records may have been accessed, suspicious account activity appears, or patient care could be disrupted. The privacy or security officer should assess whether further legal or regulatory action is required.