Smishing Incident Response Checklist for Refractive & Cataract ASCs

Smishing Incident Identification

Recognize the threat in an ASC context

Smishing—SMS-based phishing—targets your clinicians, schedulers, and billing staff with urgent, believable texts. For refractive and cataract ASCs, lures often mention surgical schedules, IOL orders, prior authorizations, refund approvals, or credentialing requests that appear to come from a surgeon, payor, or vendor.

Common red flags

• Unexpected texts asking you to click a link, install an app, or verify EHR access.
• Sender numbers that are short codes, spoofed local numbers, or unfamiliar international codes.
• Spelling/grammar oddities, mismatched branding, or URLs that imitate payors, IOL vendors, or your electronic health record security portal.
• Pressure tactics: “urgent schedule change,” “claim denial,” “patient refund pending,” or “MFA reset required now.”

First-line triage and documentation

• Do not tap links or reply. Capture screenshots showing the full message, sender number, and time.
• Forward to your security mailbox or IR chat channel per your cybersecurity incident protocol.
• Record impacted users, devices, and any credentials entered. Note whether PHI may be implicated.
• Preserve original SMS where possible; avoid deleting until investigation concludes.

Use tooling to aid identification

Enable smishing detection tools on corporate mobile devices and within your MDM/MAM stack. Configure URL rewriting and safe-browsing controls. Align monitoring with ASC compliance requirements and the HIPAA security rule so alerting, logging, and retention support both operations and audits.

Immediate Response Actions

If a suspicious text is received

• Stop interaction immediately; report internally using your cybersecurity incident protocol.
• Block the sender on the device and request carrier/network blocking through IT.
• Submit screenshots and any clicked URLs for sandbox analysis; do not forward to external parties.

If a link was clicked or credentials entered

• Force password resets for the affected account(s) and any reused credentials. Require multi-factor authentication.
• Invalidate active sessions and tokens for EHR, billing, email, cloud apps, and VPN.
• Review account recovery settings and remove unauthorized MFA methods, phone numbers, or authenticator enrollments.

If a device may be compromised

• Isolate via MDM: quarantine network access, disable corporate app connectivity, and trigger a malware scan.
• Collect device logs before wiping. If compromise is confirmed, re-enroll the device and restore only from known-good backups.
• Document actions, times, and handlers to maintain chain of custody.

Protect high-value systems

• Temporarily restrict external access to the EHR and practice management portals if risk escalates.
• Increase conditional-access prompts and step-up MFA for privileged users.
• Enable enhanced logging for identity, EHR, and SSO to capture attempted use of stolen credentials.

Communication and Notification

Internal coordination

Activate your incident bridge with security, privacy, compliance, IT, clinical leadership, and business office. Issue a single, clear internal bulletin: describe the smishing theme, instruct staff not to engage, provide the approved reporting path, and share safe examples of what to watch for.

External stakeholders

• Notify critical vendors if their brands are being spoofed or if their accounts are affected.
• Coordinate with your SMS provider or carrier to request sender blocking and intelligence.
• Engage cyber insurance if applicable; follow policy reporting timelines.

Regulatory and patient notification

Conduct a prompt risk assessment to determine whether unsecured PHI was accessed, acquired, or reasonably compromised. If so, execute your PHI breach notification process consistent with federal and state requirements, payer contracts, and ASC compliance requirements. Use plain-language notices and provide validated callback numbers your patients can trust.

Investigation and Containment

Build the timeline

• Establish first sighting, propagation paths, and high-risk user groups (schedulers, on-call surgeons, billing staff).
• Correlate SMS events with identity logs, EHR access logs, email, VPN, and MDM telemetry.

Collect and preserve evidence

• Raw SMS content and headers, sender numbers/short codes, URLs, and landing pages.
• DNS, proxy, and endpoint telemetry for devices that interacted with the message.
• EHR audit trails: user, timestamp, patient chart access, exports, and report runs.

Contain access abuse

• Block malicious domains/URLs, short codes, and hosting IPs at firewall/DNS layers.
• Disable suspicious accounts; remove newly added MFA devices and recovery methods.
• Force global password resets for targeted groups if credential spraying is detected.

Assess potential PHI exposure

Cross-reference EHR audit logs with user activity during the exposure window. Look for unusual queries, bulk exports, or access outside normal roles. Document findings to support any PHI breach notification decisions and downstream remediation.

Remediation Steps

Strengthen identity and access

• Mandate phishing-resistant multi-factor authentication for EHR, SSO, VPN, email, and billing systems; minimize reliance on SMS codes.
• Harden account recovery, disable legacy protocols, and enforce least privilege with just-in-time elevation for administrators.

Harden devices and networks

• Standardize MDM baselines with app allowlists, OS patch SLAs, encrypted storage, and browser isolation for unknown links.
• Deploy mobile threat defense and smishing detection tools that analyze SMS URLs and behavior in real time.
• Enable DNS filtering and web isolation for staff who must interact with external links as part of their duties.

Elevate electronic health record security

• Shorten idle timeouts, reduce concurrent sessions, and require step-up MFA for sensitive actions (exports, report runs).
• Conceal PHI in notifications, disable risky API keys, and review third-party EHR app permissions.
• Apply geolocation and device posture checks before allowing mobile EHR access.

People, process, and policy

• Update your cybersecurity incident protocol with this playbook, clear roles, and paging trees.
• Run targeted smishing simulations for ASC staff; include ophthalmology-specific lures.
• Review vendor contracts for security obligations and right-to-audit language.

Post-Incident Review

Lessons learned and metrics

• Capture time-to-detect, time-to-contain, accounts reset, affected devices, and any PHI risk outcomes.
• Identify control gaps across identity, device, EHR, training, and vendor oversight.

Compliance artifacts

• Maintain the incident report, evidence log, risk assessment, and notification records per ASC compliance requirements.
• Map corrective actions to the HIPAA security rule safeguards and track ownership and due dates.

Summary

A disciplined, repeatable response—rapid identification, swift containment, clear communication, and measured remediation—protects your patients and operations. By aligning controls with the HIPAA security rule, enforcing strong multi-factor authentication, deploying smishing detection tools, and tightening electronic health record security, your refractive and cataract ASC can reduce risk and recover quickly.

FAQs.

What immediate actions should ASCs take upon detecting smishing?

Stop interaction, capture screenshots, and report via your cybersecurity incident protocol. If any link was clicked or credentials entered, force password resets, revoke sessions, and isolate affected devices through MDM. Elevate logging on EHR and identity systems, and block the sender and related domains while the investigation proceeds.

How can staff identify smishing attempts targeting ASCs?

Look for urgent requests tied to surgery schedules, IOL orders, refunds, or “MFA resets,” especially from unfamiliar numbers or spoofed names. Verify URLs carefully, watch for grammar inconsistencies, and treat any request for credentials or payment as suspicious. When unsure, contact the supposed sender using a known channel, not the number in the text.

When should ASCs notify regulatory bodies about smishing incidents?

After a risk assessment indicates unsecured PHI may have been accessed or acquired, initiate PHI breach notification in line with federal and state requirements, payer contracts, and your policies. Coordinate with your privacy officer and legal counsel to determine who must be notified and within what timelines, and document the decision-making process.

What are the best practices for preventing smishing attacks in healthcare settings?

Adopt phishing-resistant multi-factor authentication, reduce reliance on SMS codes, and deploy smishing detection tools across managed devices. Train staff with realistic simulations, enable DNS and web filtering, harden EHR access controls, and ensure your cybersecurity incident protocol is tested through regular tabletop exercises.