SIM Swap Attack Response Checklist for Surgical Oncology Practices

A SIM swap can redirect a practice phone number to a device controlled by someone else, potentially allowing that person to intercept calls or text-message authentication codes. For a surgical oncology practice, respond promptly to protect accounts and patient care—but treat lost cellular service as a warning sign, not proof that patient information was accessed.

How can a surgical oncology practice recognize a SIM swap attack?

A sudden loss of cellular service may have ordinary causes, but it warrants a prompt check when it is unexplained or coincides with unusual account activity. A SIM swap occurs when a number is moved to a different SIM or device; port-out fraud transfers the number to another carrier. The Federal Communications Commission’s order on SIM-swap and port-out fraud describes these attacks and the risk to accounts that use text messages for verification.

• Notice whether a practice or staff phone unexpectedly cannot place calls, receive calls, or get texts despite having coverage.
• Look for carrier alerts about a SIM or eSIM change, device activation, account update, or number port that the practice did not request.
• Watch for unexpected password-reset messages, one-time passcodes, MFA prompts, or notifications that account recovery details have changed.
• Check for unusual sign-ins, changed forwarding rules, unfamiliar devices, or account changes involving practice email, cloud services, VPN, EHR, or administrator accounts.
• Ask the affected staff member whether the service interruption began after a carrier interaction or unexpected request for account details.

Do not assume that a phone outage alone means the EHR or protected health information (PHI) was exposed. It is an indicator to investigate promptly, especially if the number is used for account recovery or multi-factor authentication.

What steps should staff take to contain an unauthorized SIM change?

Use a separate, trusted phone or contact method to begin containment; do not rely on the potentially compromised number. Follow the practice’s HIPAA Security Rule incident response procedures, and notify the designated security or privacy lead and practice leadership. HHS says regulated entities must identify and respond to suspected or known security incidents, mitigate harmful effects where practicable, and document incidents and outcomes in its Summary of the HIPAA Security Rule.

• Contact the wireless carrier through a known, independently verified number or account portal. Ask it to investigate and reverse an unauthorized SIM change or port, restore the number, and secure the account against further changes.
• Ask the carrier what protections it offers, such as an account PIN, number-transfer lock, or carrier account port-out protection. Record the carrier’s case number and the time of each contact.
• Tell IT or the security lead to consider temporarily disabling SMS-based recovery or authentication for accounts tied to the affected number, using established procedures to avoid locking out authorized users.
• Preserve relevant carrier notices, messages, and account alerts. Avoid deleting messages or resetting devices before IT has considered whether information on them may be evidence.
• Do not send patient details, credentials, or recovery codes over ordinary text messages or through unapproved channels while the incident is being assessed.

Keep communications factual and limited to people who need to respond. Ask staff not to confront a suspected attacker or share incident details publicly.

How should staff secure compromised accounts and authentication methods?

Assume that text messages and calls to the affected number may be controlled by someone else until the carrier confirms otherwise. From a trusted device and network, prioritize accounts that can reset other accounts or access PHI, such as practice email, identity-management tools, VPN, EHR, and administrator accounts.

• Change potentially exposed passwords to unique passwords, starting with email and other account-recovery hubs. Revoke active sessions and unknown devices where the service allows it.
• Remove the affected phone number as a recovery or MFA option where appropriate, and review recovery addresses, forwarding settings, trusted devices, and authorized users.
• Replace SMS one-time passcodes with phishing-resistant MFA, such as a FIDO security key or passkey, when the service supports it. CISA recommends phishing-resistant FIDO authentication and warns that SMS MFA is not phishing-resistant in its Mobile Communications Best Practice Guidance.
• If a service does not support security keys or passkeys, consider an authenticator app as an alternative to SMS. App-generated codes can still be phished, so they are not equivalent to phishing-resistant authentication.
• Review whether multi-factor authentication recovery codes exist for affected accounts. Generate new codes if needed, invalidate old ones when supported, and store the new codes in an access-controlled location separate from the compromised phone number.
• Ask the EHR, email, identity, and other relevant vendors to review access and security events and to help secure affected accounts. Follow applicable business associate agreement (BAA) reporting and cooperation terms.

Keep at least two authorized people able to use the organization’s approved recovery process, but limit access to recovery codes and administrator privileges. Avoid creating informal workarounds that weaken controls or leave accounts without an accountable owner.

How can the practice maintain clinical operations during response?

Activate the practice’s approved downtime or emergency operations procedures if phone service, messaging, or systems needed for care are disrupted. HHS describes contingency planning under the Security Rule as including procedures for continuing critical business processes while operating in emergency mode in its Security Rule summary.

• Assign a response lead and a clinical operations lead so incident containment and patient-care coordination proceed in parallel.
• Use verified backup contact methods and the practice’s established patient communication workflow. Confirm that staff know which numbers or channels are approved.
• Follow the practice’s documented EHR downtime and recovery procedures. Record care delivered during downtime and reconcile it into the record using approved workflows when systems are restored.
• Use only approved secure channels for patient information. Do not substitute personal email, consumer messaging apps, or unapproved devices for clinical communications.
• Prioritize time-sensitive surgical oncology coordination, including scheduled procedures, urgent symptoms, treatment changes, and communications with hospitals or other care partners.
• Tell staff where to report suspected account or device issues, and provide brief updates through a trusted communication channel.

Once service returns, verify the affected number and accounts with the carrier and IT before treating them as trusted. Resume routine workflows only after the practice has confirmed that access and communications are operating safely.

How should the practice assess potential EHR and PHI exposure?

A compromised phone number does not by itself establish that someone accessed an EHR or PHI. Determine which accounts used the number for login, password reset, or MFA, then review available electronic health record audit logs and related identity, email, VPN, and cloud-service records for suspicious activity.

• Ask IT and relevant vendors to preserve and review sign-in, access, session, account-change, and audit records for the affected period. Include failed and successful logins, unfamiliar devices or locations, and changes to recovery methods.
• Identify whether any unauthorized account could view, download, alter, transmit, or delete ePHI. Determine which systems, records, and individuals may have been involved, and whether the information was actually accessed or acquired.
• Check whether exposed data was encrypted in a manner that meets HHS guidance for rendering PHI unusable, unreadable, or indecipherable to unauthorized persons. Do not assume that the presence of encryption alone resolves the assessment.
• Document the practice’s protected health information breach assessment, including what evidence is available, what remains uncertain, and what steps were taken to mitigate risk.

Under the HIPAA Breach Notification Rule, an impermissible use or disclosure of PHI is generally presumed to be a breach unless an exception applies or the covered entity or business associate demonstrates a low probability that the PHI was compromised through a risk assessment. HHS identifies factors including the nature and extent of PHI, who received or used it, whether it was actually viewed or acquired, and mitigation measures in its Breach Notification Rule guidance.

What incident details and reporting obligations should the practice document?

Maintain a contemporaneous incident record and preserve relevant evidence. A clear incident chain of custody is a sound way to track who collected, accessed, transferred, or stored evidence; it supports a reliable investigation but should not be presented as a stand-alone HIPAA requirement.

• Record when the service disruption or suspicious activity was first noticed, when it was reported, the affected phone number and accounts, and the actions taken with their dates and times.
• Document carrier contacts, case numbers, notices, account changes, vendor notifications, internal decisions, and the people who made or approved them.
• Preserve original alerts, relevant logs, screenshots, and other evidence in an access-controlled location. Record who collected each item, when it was collected, where it was stored, and any transfer or access.
• Document the scope and results of the PHI risk assessment, including the information involved, the people or systems potentially affected, evidence of access or acquisition, and mitigation.
• Consult the privacy or security officer, legal counsel, insurers, and relevant vendors as required by the practice’s policies and agreements. Consider applicable state law and contractual duties as well as HIPAA.

A suspected SIM swap is not automatically a reportable HIPAA breach, and HIPAA does not generally require reporting every suspected SIM swap to law enforcement. If there is evidence of cybercrime, the practice may report it to appropriate law enforcement or the FBI’s Internet Crime Complaint Center; preserve evidence and avoid delaying required regulatory decisions while doing so.

If the assessment establishes a breach of unsecured PHI, the practice must follow applicable HIPAA notification requirements. HHS states that individual notices must be provided without unreasonable delay and no later than 60 days after discovery; reporting timelines to HHS differ depending on whether 500 or more individuals are affected, and additional media notice may apply in certain cases. Consult the current HHS breach notification guidance and legal counsel for the incident’s specific facts.

In short, treat unexplained phone-service loss as a prompt to verify the carrier account, contain access risks, protect clinical operations, investigate system logs, and document the PHI assessment. Do not equate a SIM swap with an EHR breach; use the evidence and applicable notification rules to determine what happened and what the practice must do next.

FAQs

What should staff do first if a practice phone suddenly loses cellular service?

Use another trusted phone or contact method to notify the practice’s security or privacy lead and contact the carrier through a verified channel. Ask the carrier to check for an unauthorized SIM change or port, secure the account, and restore control of the number. Staff should not use the affected number to receive authentication codes while the issue is being checked.

Can a SIM swap expose patient information in an EHR?

Potentially, if the number is used to receive login or password-reset codes for an account that can access the EHR. A SIM swap alone does not prove that the attacker accessed the EHR or PHI. Review authentication and EHR audit logs, account-recovery activity, and vendor records to assess whether access occurred.

Should the practice report a suspected SIM swap to law enforcement?

HIPAA does not generally require a practice to report every suspected SIM swap to law enforcement. If evidence suggests a crime or PHI exposure, the practice can consider contacting appropriate law enforcement or filing a report with the FBI’s Internet Crime Complaint Center. Coordinate with the practice’s security or privacy lead and counsel, preserve evidence, and separately assess any HIPAA or state-law reporting duties.

What authentication methods are safer than SMS one-time passcodes?

FIDO security keys and passkeys provide phishing-resistant authentication when supported by the service. Authenticator apps are generally preferable to SMS in a SIM-swap scenario, but one-time codes from an app can still be captured through phishing. Review each account’s recovery options as well, because an SMS fallback can remain a weak point even after stronger MFA is enabled.