Smishing Incident Response Checklist for Pediatric Aerodigestive Centers

A text message that imitates a caregiver, clinician, delivery service, or health technology vendor can lead staff to a fake login page or harmful software. For a pediatric aerodigestive center, a suspected smishing event can put staff accounts, clinical systems, patient care, and protected health information at risk.

Use this checklist to guide prompt reporting and coordinated response. Follow your organization’s incident response plan and involve IT or security, privacy, and compliance staff early. A suspected incident is not automatically a reportable breach; the center must assess the facts and applicable requirements.

How should a pediatric aerodigestive center identify and report a smishing message?

Smishing is phishing delivered by text message. A suspicious text may use an urgent or alarming request, impersonate someone the recipient knows, contain an unexpected link, or ask for a password, verification code, or patient-related information. A convincing logo or familiar name does not prove the message is legitimate.

When staff receive a suspected smishing text, they should:

• Stop: do not tap the link, open an attachment, reply, call a number in the text, or enter information.
• Report it promptly through the center’s established security reporting channel. Include the time received, sender information, message content, and whether anyone clicked, replied, or shared data.
• Preserve the original message and a screenshot if safe to do so. Do not forward it to colleagues or a work group unless the security team instructs you to use an approved reporting method.
• Wait for the response team’s instructions before deleting the message or blocking the sender, so useful evidence is not lost.

Staff can verify a claimed request using a known directory number or trusted website—not contact details in the text. For personal reporting of an unwanted message, the Federal Trade Commission’s guidance on reporting spam texts explains how to forward a message to 7726 (SPAM) or report it to the FTC. Those options do not replace internal incident reporting.

What steps should staff take after clicking a suspicious link or sharing credentials?

Report the interaction immediately, even if the page looked blank, the message disappeared, or no information was intentionally submitted. Clicking alone does not establish that a device or account was compromised, but it warrants assessment. Be specific about what happened: whether you opened the link, downloaded anything, entered a password or verification code, approved a sign-in prompt, or shared patient or caregiver information.

• If you entered a work password or code, contact IT or security using a separate, trusted device or phone number. Do not use the suspicious link again.
• From a trusted device, change the exposed password as directed, revoke active sessions, and review account recovery methods and recent sign-ins. If the password was reused, tell security so they can help prioritize other affected accounts.
• If you approved an unexpected multifactor authentication (MFA) prompt, report that detail immediately. MFA can reduce account-takeover risk, but an unexpected approval or stolen code may still allow access.
• If you downloaded a file or the device behaves unusually, stop using it for work and ask IT how to isolate it. Do not factory-reset it, delete evidence, or try to investigate it yourself unless instructed.
• If you disclosed patient, caregiver, or employee information, tell the privacy or compliance team what information was shared and with whom, if known. Do not contact affected families on your own.

Prompt reporting helps the response team limit possible harm and determine whether the event affected electronic protected health information (ePHI) or other systems.

How should the center contain affected devices and accounts?

IT or the designated security lead should direct containment based on what the staff member did and which systems may be involved. A containment action that is appropriate for a work-managed device may not be suitable for a personal phone or a device needed for patient care.

• Disable or secure potentially exposed accounts as needed, revoke active sessions and suspicious tokens, and reset credentials from a trusted device.
• Isolate a suspected compromised workstation or mobile device from organizational systems when directed. Preserve it for examination rather than wiping or repairing it before security staff assess it.
• Check for unauthorized mailbox rules, forwarding, connected applications, new authentication methods, or unusual account activity.
• Block confirmed malicious domains, phone numbers, or sender patterns through managed security tools, while preserving relevant evidence.
• Assess whether the event reached shared mailboxes, scheduling and referral tools, the electronic health record, telehealth services, patient portals, or vendor systems.
• Maintain safe access to urgent clinical information and care workflows. If systems are unavailable, use the center’s approved downtime or emergency procedures and limit access to authorized personnel.

The HHS summary of the HIPAA Security Rule describes the requirements to respond to and document security incidents, protect ePHI, and maintain appropriate contingency procedures. Containment should therefore address both security and continuity of care.

How can the center assess exposure of pediatric patient and caregiver information?

The security and privacy teams should establish what happened, which accounts and systems were affected, and whether information was accessed, acquired, altered, or disclosed. Do not assume that information was exposed solely because a text was received—or assume that it was safe because no one noticed suspicious activity.

For a center serving children, check whether affected records or communications may include:

• Patient names, dates of birth, contact details, diagnoses, treatment plans, or appointment information.
• Caregiver or family contact details, portal access, messages, or payment information held by the center.
• Information in referral documents, airway or feeding evaluations, procedure schedules, care coordination messages, and connected clinical systems.
• Credentials or messages that could provide access to other accounts containing protected health information (PHI) or ePHI.

Review access logs, authentication events, email audit records, device and endpoint alerts, and relevant vendor logs. Determine the time window, account permissions, data available to the account, and evidence of viewing, downloading, forwarding, or changes. Record uncertainties and continue updating the assessment as evidence develops.

If an impermissible use or disclosure of PHI may have occurred, the center’s privacy team should conduct a documented security incident risk assessment. HHS identifies four factors to consider: the nature and extent of PHI involved, who received or used it, whether it was actually acquired or viewed, and how effectively the risk was mitigated. See the HHS Breach Notification Rule guidance. The assessment should also consider applicable exceptions and whether the PHI was unsecured.

Which teams and authorities should coordinate the incident response?

Use a clear incident lead and involve the people needed to contain the event, assess patient and organizational risk, and meet any applicable reporting duties. Depending on the center’s structure and the incident’s scope, coordinate with:

• IT, cybersecurity, or the managed security provider for technical investigation, containment, recovery, and evidence preservation.
• The privacy officer, compliance lead, and legal counsel for PHI analysis, breach assessment, notification decisions, and applicable state requirements.
• Clinical leadership and operations for patient safety, scheduling, referral coordination, and continuity-of-care planning.
• Communications and patient-relations staff for consistent, approved communications with families and employees.
• Affected vendors, such as an electronic health record, portal, telecommunications, or cloud provider, under the applicable contract and business associate agreement.
• The cyber insurer or incident response firm, if the center’s policy or response arrangements call for their involvement.

Law enforcement or government cyber authorities may be appropriate for suspected criminal activity, extortion, or a broader attack. The center should coordinate any external reporting with counsel and its incident lead. Reporting a scam text to the FTC or a carrier is separate from HIPAA breach notification and does not determine whether a breach occurred.

What notification and documentation requirements may apply?

A smishing message or compromised account does not, by itself, establish that HIPAA breach notifications are required. If the event involves an impermissible use or disclosure of unsecured PHI, the covered entity generally must treat it as a breach unless it documents a low probability that the PHI was compromised based on the required risk assessment or establishes an applicable exception. Counsel and the privacy officer should also evaluate state law, contracts, and other requirements that may apply.

For a reportable breach of unsecured PHI under HIPAA, covered entities generally must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery. They must notify HHS; the reporting deadline depends on the number of affected individuals. For fewer than 500 individuals, HHS reporting is due within 60 days after the end of the calendar year in which the breach was discovered. For 500 or more, the deadline is without unreasonable delay and no later than 60 days after discovery. Media notification may also be required when a breach affects more than 500 residents of a state or jurisdiction. See HHS’s breach notification overview and HHS’s breach reporting instructions.

If a business associate is involved, review the business associate agreement and coordinate its notice to the covered entity. HIPAA requires a business associate to notify the covered entity of a breach without unreasonable delay and no later than 60 days after discovery, though an agreement may set a shorter reporting timeline. The covered entity remains responsible for ensuring required individual notice is provided.

Maintain a contemporaneous incident record that includes:

• When the message was received and discovered, who reported it, and the actions taken.
• The message and relevant screenshots, sender details, affected devices, accounts, systems, vendors, and evidence sources.
• Containment and recovery steps, investigation findings, affected information and individuals, and any unresolved uncertainties.
• The security incident risk assessment, its rationale and conclusion, notification decisions, approvals, and copies or records of notifications made.
• Corrective actions, assigned owners, completion dates, and any follow-up review.

The HHS Security Rule summary explains documentation expectations under HIPAA. The organization should follow its retention policy and applicable legal requirements, including the HIPAA documentation retention period where it applies.

How can the center strengthen smishing prevention and response?

Prevention works best when staff know how to report suspicious texts and the center can rapidly disable exposed access. Review the incident response plan regularly and make its reporting route easy to find during busy clinic operations.

• Train employees to verify unusual requests through a known contact method and to report suspicious texts without fear of blame.
• Use multifactor authentication for organizational accounts where available, with stronger phishing-resistant options for high-risk access when feasible.
• Apply role-based access, least privilege, device security controls, timely software updates, and monitoring for unusual logins and account changes.
• Set clear rules for work and personal phones, patient communications, password storage, and approved applications.
• Test the incident response plan with realistic scenarios involving clinical staff, patient portals, caregiver communications, and vendor systems.
• Review lessons from incidents and exercises, update staff guidance, and confirm that downtime procedures support safe patient care.

The HIPAA Security Rule requires covered entities to maintain appropriate safeguards and respond to and document security incidents; the specific measures should reflect the organization’s risks and circumstances. The HHS Security Rule summary explains this flexible, risk-based approach. For broader incident response planning, see NIST Special Publication 800-61 Revision 3.

In summary: report suspected smishing quickly, contain affected access with IT guidance, assess any exposure of patient and caregiver information, and document the reasoning behind response and notification decisions. A practiced incident response plan helps protect ePHI while supporting continuity of pediatric care.

FAQs

What should staff do first after receiving a suspected smishing text?

Do not click, reply, call numbers in the message, or enter information. Report it through the center’s established security channel and preserve the message as instructed. Verify any claimed request using a known, trusted contact method.

What should staff do if they entered credentials on a smishing link?

Contact IT or security immediately using a trusted device or phone number. Follow instructions to reset the exposed password, revoke active sessions, and review account activity. Report any verification codes approved or patient information entered, and do not use the suspicious link again.

When must a pediatric aerodigestive center notify patients or regulators after a smishing incident?

Only after the center determines that notification is required under the applicable rules. For a reportable breach of unsecured PHI under HIPAA, affected individuals generally must be notified without unreasonable delay and no later than 60 calendar days after discovery. HHS reporting deadlines depend on how many individuals are affected, and state laws or contracts may impose additional requirements. The privacy officer and counsel should assess the facts and applicable deadlines promptly.

How should the center document a smishing incident involving patient information?

Record the timeline, message details, affected accounts and systems, evidence reviewed, containment actions, investigation findings, potential information involved, and any uncertainties. Document the security incident risk assessment, notification decision and rationale, approvals, notices made, and corrective actions. Limit access to incident records to authorized personnel and retain documentation under applicable requirements and organizational policy.