Smishing Incident Response Checklist for a Primary Ciliary Dyskinesia Center

A suspected smishing incident—a phishing attempt delivered by text—can expose staff credentials, disrupt clinic systems, or put patient information at risk. Use this smishing incident response checklist to report the message, contain possible compromise, assess protected health information (PHI) exposure, and maintain safe clinical operations.

Follow your center’s incident response, privacy, and clinical downtime procedures. Notify the designated security and privacy leads promptly; don’t wait to determine whether the message is genuine.

How should staff report and preserve a suspicious text?

• Do not reply, tap links, open attachments, or call numbers in the message. Report it through the center’s approved security channel or to the designated IT contact. CISA advises people not to reply or click suspicious links and to report phishing. See CISA’s phishing tip sheet.
• Preserve the evidence. Keep the original message and record the sender’s number or short code, the date and time received, the recipient, and any link or attachment details visible without opening them. Take a screenshot if your policy allows it.
• Use an approved reporting method. Don’t forward the text to a personal phone or email account. If IT requests that you forward it, use the clinic-approved process so the message can be reviewed safely.
• Record any interaction. Tell IT whether anyone replied, clicked, entered a password, approved a multi-factor authentication prompt, downloaded a file, or shared patient or clinic information. Include approximate times and the device used.

Staff should avoid deleting the message or resetting a device before IT advises them, because those steps may remove useful evidence. If the message is on a personal device used for clinic work, report that too; don’t send patient information in an ordinary incident ticket unless the approved process permits it.

How can the center contain possible account compromise?

If a staff member entered a password, approved an unexpected authentication prompt, or suspects an account was accessed, notify IT immediately. IT should secure the account from a trusted device and review relevant sign-in and authentication logs, including unfamiliar devices, locations, times, and failed or successful sign-ins.

• Reset the affected password and revoke active sessions or tokens, as appropriate. Don’t change the password from a device that may be compromised.
• Review multi-factor authentication (MFA) methods and recent prompts. Remove an untrusted factor and complete a multi-factor authentication reset through the center’s identity-verification process.
• Check for changes to recovery details, email forwarding rules, mailbox permissions, or account privileges.
• Consider temporarily restricting or disabling the account if there is evidence of unauthorized access. Coordinate with clinical leadership to avoid interrupting urgent care or essential duties.
• Preserve relevant authentication logs and other records before they expire or are overwritten.

HIPAA requires regulated entities to have procedures to identify and respond to suspected or known security incidents, mitigate harmful effects where possible, and document incidents and their outcomes. See HHS’s Summary of the HIPAA Security Rule.

What steps should follow a clicked link or downloaded file?

Tell IT exactly what happened, including whether the user entered credentials, permitted a download, opened a file, or saw a warning. Stop interacting with the message or downloaded content. Don’t attempt to delete files, uninstall software, or run cleanup tools unless IT directs you to do so.

• Follow IT’s instructions to disconnect the affected device from the network or isolate it. Use another trusted device for urgent communications.
• Have IT or an approved security specialist inspect the device and run an endpoint antivirus scan. A clean scan alone may not establish that an account or device is safe; IT should review the results alongside other evidence.
• Review device activity, security alerts, browser downloads, and account access around the time of the click. Preserve findings for the incident record.
• If the device may have accessed the electronic health record (EHR), email, scheduling, or other systems containing ePHI, involve the privacy and security leads in the exposure assessment.

CISA’s phishing response guidance recommends re-provisioning suspected or confirmed compromised accounts, auditing account access, isolating affected workstations, and arranging malware analysis where needed. See CISA’s phishing incident response guidance.

How should the incident team assess potential system and data exposure?

The incident team should establish a timeline and determine what the message targeted, which accounts or devices may have been involved, and what those accounts could access. Examine authentication logs and available email, EHR, endpoint, network, and cloud-service records for suspicious sign-ins, changes, downloads, or other activity.

• Identify affected staff accounts, devices, phone numbers, applications, and shared or privileged accounts.
• Determine whether the sender obtained credentials or whether the user approved an unexpected MFA request.
• Check whether access continued after a password change or account restriction; revoke sessions or credentials as needed.
• Look for unusual access to patient charts, scheduling details, diagnostic results, messages, or exported records, while preserving relevant logs.
• Assess whether the event affected the confidentiality, integrity, or availability of systems or ePHI, and whether related vendors or business associates need to be contacted.

Coordinate vendor incident response according to the center’s contracts and business associate agreements (BAAs). HHS explains that a BAA must require a business associate to report security incidents involving ePHI it maintains. See HHS’s guidance on cloud service provider incident reporting.

How should the center evaluate possible protected health information exposure?

Involve the privacy officer or designated privacy lead. Determine whether PHI was accessed, used, or disclosed impermissibly—not merely whether a suspicious text arrived. Consider whether the attacker could access a clinic account, whether patient records or messages were viewed or obtained, and whether any PHI was sent in a reply or entered into a fraudulent site.

For an impermissible use or disclosure, the HIPAA Breach Notification Rule generally presumes a breach unless the covered entity or business associate documents a low probability that PHI was compromised through a risk assessment. HHS identifies four factors for that assessment:

1. The nature and extent of the PHI, including identifiers and the likelihood of re-identification.
2. The unauthorized person who used or received the information.
3. Whether the PHI was actually acquired or viewed.
4. The extent to which the risk was mitigated.

Apply the factors to the available evidence and document the reasoning, uncertainties, and mitigation. Don’t assume that a phishing message alone proves PHI exposure—or that lack of visible evidence proves no exposure. See HHS’s HIPAA Breach Notification Rule guidance.

If the center determines that a breach of unsecured PHI occurred, the notification requirements depend on the facts and number of affected individuals. HHS states that individual notice must be provided without unreasonable delay and no later than 60 days after discovery; other federal reporting requirements may apply, and applicable state law or contract terms may also need review. Consult the privacy lead and legal counsel about the required notices and timing.

How can clinical operations continue during the response?

Use the center’s clinical downtime procedures if the response requires taking an account, device, or system offline. The HIPAA Security Rule requires contingency planning that supports critical business processes while protecting ePHI during emergency operations. See HHS’s Summary of the HIPAA Security Rule.

• Have clinical leadership identify urgent appointments, time-sensitive testing, and essential patient communications that could be affected.
• Use approved downtime methods for scheduling, documentation, and communication. Limit access to paper records and other temporary records to authorized staff.
• Provide staff with a trusted contact method for incident updates and patient-care coordination; don’t use the suspicious text thread.
• Confirm with IT and clinical leadership before restoring access to any isolated account or device.
• When systems are restored, reconcile downtime records into the approved system and handle temporary records under the center’s retention and privacy procedures.

Keep operational decisions focused on both continuity and privacy: preserve access to essential care workflows without bypassing safeguards or using unapproved devices and accounts.

What should the center document and review during recovery?

Maintain an incident record that captures the report, response, evidence reviewed, decisions made, and recovery steps. Restrict access to incident documentation and avoid including unnecessary PHI in general-purpose tickets or email.

• Record when the text was received and reported, who was involved, what actions were taken, and when accounts or devices were contained and restored.
• Document the evidence reviewed, including relevant authentication logs, endpoint antivirus scan results, vendor findings, and the limits of available evidence.
• Keep the HIPAA breach risk assessment and the rationale for any notification decision with the incident documentation.
• Record vendor incident coordination, clinical downtime decisions, patient-care impacts, and any required notifications.
• Review whether staff reporting instructions, access controls, MFA processes, device protections, vendor contacts, and clinical downtime procedures need improvement.

Close the response only after the designated leads confirm that containment and recovery steps are complete, outstanding exposure questions are assigned, and corrective actions have owners and deadlines. A clear record of the incident, its outcome, and lessons for future response supports safer recovery.

FAQs.

Should staff reply to a suspected smishing text?

No. Don’t reply, click a link, open an attachment, call a number in the message, or respond to an authentication prompt it triggers. Report the message through the center’s approved process and preserve it for review.

What should staff do after clicking a link in a suspicious message?

Stop interacting with the page or downloaded content and report the click to IT immediately. Explain whether you entered credentials, approved an MFA prompt, or downloaded or opened a file. Follow IT’s instructions for device isolation, account security, and review; don’t try to clean up the device yourself.

How should a primary ciliary dyskinesia center assess possible PHI exposure?

Have the privacy and security leads determine whether an account or device accessed patient information, such as records, messages, results, or scheduling details. Review available logs and other evidence, then document the HIPAA breach risk assessment using the four required factors: the nature and extent of PHI, the recipient or unauthorized user, whether PHI was acquired or viewed, and mitigation.

How can clinic services continue during a smishing response?

Use the center’s clinical downtime procedures and have clinical leadership prioritize essential care and communications. Use approved temporary workflows, protect any paper records, coordinate changes with IT, and reconcile downtime documentation after systems are safely restored.