Smishing Incident Response Checklist for Health Care Transition Clinics

A suspicious text can be a routine phishing attempt—or the first step in an account or device compromise. For a health care transition clinic, a quick, coordinated response can help protect patient information, maintain referral and follow-up workflows, and avoid disrupting care.

Use this checklist alongside your clinic’s incident response plan. Report suspected incidents promptly to your designated incident response personnel; staff should not try to investigate or contain a suspected compromise on their own.

How can clinic staff identify and verify a suspicious text message?

Smishing is phishing delivered by text message. Treat an unexpected message as suspicious if it asks you to sign in, disclose a password or verification code, open an attachment, install an app, or act urgently. Be cautious of messages claiming to come from a patient, clinician, referral partner, pharmacy, insurer, or technology vendor when the request is unexpected or unusual.

• Check the sender and context, but don’t rely on a familiar name or phone number alone; sender details can be misleading.
• Look for pressure tactics, unexpected links, unusual payment requests, or requests to move a conversation to a different channel.
• Verify the request independently. Use a phone number or contact method already in your clinic directory or official records—not one supplied in the message.
• Do not enter protected health information (PHI), passwords, or multifactor authentication codes on a page reached through a suspicious text.

If you are unsure, don’t reply or click. Follow your clinic’s reporting process and preserve the message for review. The CISA phishing and spoofing tip sheet advises recipients not to respond to or click links in messages they can’t verify and to contact the organization through a known channel.

What immediate steps should staff take after receiving a smishing message?

Report the message promptly to your supervisor and the clinic’s designated incident response personnel, such as IT or security, privacy, or compliance staff. Follow internal escalation instructions even if you did not click anything; early reporting helps the team determine whether others received the same message.

• Don’t reply, click a link, open an attachment, call a number in the text, or share a verification code.
• Keep the original message on the device if safe to do so. Don’t delete it until the response team says it is no longer needed.
• Record when you received it, which device received it, and whether you interacted with it. Use the clinic’s approved reporting channel.
• Don’t forward the text to coworkers or personal accounts. If the response team requests a copy, use its approved secure method.
• If you already clicked, replied, downloaded something, or entered information, tell the response team exactly what happened and when. Report it without delay; don’t wait to confirm whether harm occurred.

HIPAA’s Security Rule requires covered entities and business associates to have procedures for identifying and responding to suspected or known security incidents, mitigating harmful effects where practicable, and documenting incidents and outcomes. See the HHS guidance on security incident procedures and business associate reporting.

How should clinics contain and secure potentially affected accounts and devices?

Have IT or the designated incident response personnel direct containment. The appropriate response depends on what happened, what device was involved, and whether isolating it could affect patient care. Don’t independently erase, reset, or power off a device, or delete messages and files; those steps can complicate investigation or recovery.

• If credentials may have been exposed: From a known-safe device, change the affected password using the clinic’s approved process. Ask IT to revoke active sessions, tokens, or other credentials as appropriate and check for unauthorized account changes.
• If a phone or computer may be affected: Ask IT whether endpoint isolation is needed. Staff should not disconnect a device from networks unless their response procedures or incident response personnel direct them to do so.
• Review multifactor authentication activity: Report unexpected approval prompts, sign-ins, changes to authentication methods, or requests for one-time codes. Never approve a prompt you did not initiate.
• Limit additional exposure: Follow instructions to secure accounts and devices used for clinic email, scheduling, referral coordination, electronic records, or other affected services.

Containment should be coordinated with clinical leaders if it could interrupt access to records, referral details, appointment information, or care coordination. The goal is to reduce further risk while keeping patient care safe.

What evidence should staff document and preserve?

Preserve enough information for the response team to assess what happened without spreading the message or exposing patient details. Follow clinic policy for securely submitting evidence, and don’t alter the original message unless directed.

• The message’s date and time, sender information, phone number, and full text.
• Any link or attachment, if the response team requests it. Don’t reopen a link or download a file to collect evidence.
• The device and account involved, whether the message was opened or answered, and any link, attachment, or sign-in page interaction.
• Any credentials or verification codes entered, account changes noticed, unexpected prompts, or unusual activity—reported through an approved secure channel.
• Actions taken, who was notified, and when. Keep a clear timeline and follow instructions about handling or transferring evidence.

Don’t put PHI into an ordinary text, personal email, or unapproved reporting system. Ask the response team how to submit screenshots or other records securely, especially if a screen contains patient information. The NIST incident response guidance describes incident response as an organized process that includes preparation, detection, response, and recovery.

How should clinics assess risks to protected health information and patient care?

The clinic’s privacy, security, compliance, and clinical leaders should assess whether the message led to unauthorized access or disclosure—not assume that receiving a suspicious text alone means PHI was exposed. They should determine which accounts, devices, systems, and information may have been involved, and whether access or changes affected referral handoffs, follow-up appointments, care plans, or communications with patients and partner organizations.

For a potential impermissible use or disclosure of PHI, the HIPAA Breach Notification Rule generally presumes a breach unless the covered entity or business associate demonstrates a low probability that the PHI was compromised through a risk assessment. HHS identifies four factors for that assessment: the nature and extent of PHI involved, who received or used it, whether it was actually acquired or viewed, and how the risk was mitigated. The clinic’s privacy or compliance lead should apply the rule to the facts and determine any notification obligations; staff should not make that determination themselves. See the HHS Breach Notification Rule guidance.

If the clinic is a covered entity, required individual notifications following a breach of unsecured PHI must be made without unreasonable delay and no later than 60 calendar days after discovery. Other reporting requirements may also apply, depending on the incident. The response team should coordinate with leadership and any affected business associates, follow applicable agreements and policies, and consult legal or compliance counsel as appropriate.

Assess patient-care risk alongside information security. If staff cannot reliably access systems or confirm the status of a referral, transition, or follow-up, escalate the issue to clinical leadership and use established clinical downtime procedures.

How can clinics recover systems and monitor for related activity?

Let IT and incident response personnel confirm that affected accounts and devices are secured before returning them to normal use. Recovery may include removing malicious software, closing the access path, restoring systems or data from verified backups, and checking that account permissions and records are reliable. Staff should use approved channels for updates and avoid resuming affected workflows on a device or account that has not been cleared.

• Confirm that affected passwords, sessions, and authentication methods have been addressed as directed by IT.
• Monitor relevant sign-in records, account changes, and multifactor authentication activity for suspicious behavior or repeat attempts.
• Check that referral, scheduling, and follow-up workflows are functioning and that any patient-care tasks delayed during the incident have been identified.
• Continue clinical downtime procedures until clinical leadership and IT confirm that normal workflows are safe to resume.
• Document recovery steps, remaining risks, and lessons for improving staff reporting and incident response.

HIPAA requires covered entities and business associates to maintain contingency planning that supports continued operations and access to electronic PHI during an emergency or disruption. See HHS guidance on the HIPAA Security Rule’s contingency plan. A coordinated response—prompt reporting, careful containment, evidence preservation, a documented risk assessment, and validated recovery—helps protect patient information while supporting continuity of care.

FAQs

Should staff reply to or click links in a suspicious text?

No. Don’t reply, click links, open attachments, or call a number included in a suspicious text. Verify any request through a contact method already known to the clinic, then report the message using your clinic’s approved process.

Who should clinic staff notify about a suspected smishing incident?

Notify your supervisor and the clinic’s designated incident response personnel, following internal policy. Depending on the clinic’s process and the potential impact, that may include IT or security, privacy or compliance staff, and clinical leadership. Don’t wait to report until you know whether an account or device was compromised.

What should staff do if they entered credentials through a text message link?

Report it immediately and describe what information you entered and when. From a known-safe device, follow IT’s instructions to change the password and secure the account. Ask the response team to assess session revocation, credential revocation, authentication settings, and related account activity. Don’t approve unexpected multifactor authentication prompts.

How should a clinic respond if patient care systems are affected?

Notify clinical leadership and incident response personnel immediately. Follow established clinical downtime procedures, use approved backup workflows, and prioritize safe care coordination and follow-up. Keep using those procedures until the responsible clinical and technical leads confirm that affected systems are safe and reliable to use.