Smishing Incident Response Guide for Sliding Fee Eligibility Databases

How can you identify a smishing attack targeting eligibility data?

Smishing is phishing delivered by text message. A message may impersonate your organization, a clinic, a supervisor, or a vendor and pressure staff to open a link, scan a QR code, call a number, or provide login details. Warning signs include unexpected requests, urgent language, shortened or misspelled links, and requests to confirm passwords or patient information. A familiar name or phone number is not proof that the message is legitimate.

For messages mentioning a sliding fee discount program, treat unexpected requests to review applications, verify income, or update patient demographic data with caution. Those records may include identifying and financial details; whether they are protected health information (PHI) depends on the information and the organization’s HIPAA role. Don’t use the link or contact details in the message to verify it. Instead, use a known internal directory or a phone number you independently confirm. CISA’s phishing guidance recommends recognizing suspicious links and reporting messages through trusted channels.

What should staff do immediately after receiving or clicking a smishing link?

If you only received the message, don’t click, reply, call numbers in it, or forward it to coworkers. Report it through your organization’s approved security channel, such as its phishing-reporting tool or IT help desk, and follow local instructions for retaining or deleting the message.

If you clicked, entered a password, approved a sign-in, or downloaded something, tell your IT or security team immediately—even if nothing unusual appeared on the screen. Include what you did and when. Don’t enter more information or attempt to investigate the link yourself. If you submitted credentials, use a trusted device and follow responders’ instructions to change the password and revoke active sessions or tokens. If you suspect the phone or device is compromised, ask the response team whether and how to isolate it; don’t wipe it or discard it before they assess evidence.

Organizations should use their documented security-incident procedures to identify and respond to suspected incidents, mitigate harmful effects where practicable, and document the incident and its outcome. The HIPAA Security Rule, 45 CFR § 164.308(a)(6), sets out these requirements for covered entities and business associates.

How can you contain exposure of sliding fee eligibility records?

Incident responders should act promptly to stop further access while preserving information needed to understand what happened. Depending on the evidence, containment may include disabling or restricting the affected account, revoking sessions and tokens, resetting credentials, blocking the malicious domain or sender, and checking for unauthorized forwarding rules or connected applications. Coordinate these actions with IT or security staff so containment does not erase useful evidence or disrupt essential services unnecessarily.

Review whether the affected phone, email, identity provider, application, or vendor account could reach the eligibility database or its exports. Restrict access to the affected records to authorized staff, and pause relevant integrations if responders determine that doing so is necessary. If the records are handled by a service provider, contact it through a verified channel and follow the incident-reporting terms in the business associate agreement, if applicable.

For high-risk accounts, multifactor authentication that resists phishing can reduce the risk that a stolen password alone will enable access. Treat it as one safeguard, not a substitute for incident containment, access review, or credential revocation.

How should organizations assess compromised credentials and data access?

Start by identifying which credentials or authentication factors may have been exposed, which systems those credentials can access, and the time period in which an attacker could have used them. Consider password submissions, one-time codes, sign-in approvals, session cookies, and tokens—not just whether a database password was entered. Revoke affected sessions and tokens, reset credentials as appropriate, and review linked accounts for suspicious changes.

Conduct access log analysis across identity, email, database, application, remote-access, and cloud systems relevant to the account. Look for unusual sign-ins, access from unexpected locations or devices, repeated authentication failures, permission changes, bulk searches or downloads, and activity outside the staff member’s normal pattern. Compare activity with the employee’s account of what happened and the system’s ordinary use. The HIPAA Security Rule requires audit controls that record and examine activity in systems containing or using electronic PHI. See 45 CFR § 164.312(b).

Document what the logs can and cannot establish. A lack of recorded suspicious activity does not by itself prove that records were not accessed, especially if relevant logging was unavailable, incomplete, or not retained for the incident period.

What evidence should be preserved for incident investigation?

Preserve the original text message and available details such as the sender information, full link, date and time, screenshots, and whether the recipient clicked, replied, entered information, or downloaded a file. Keep relevant emails, call records, system alerts, and the staff member’s contemporaneous account of events. Avoid clicking the link again to capture it.

Security staff should preserve relevant identity, email, endpoint, network, application, and database logs before routine retention or rotation removes them. Record the systems and time ranges collected, the time zone used, who collected each item, and any transfers or handling. Limit access to evidence and store it securely. NIST Special Publication 800-61 Revision 3 provides current incident-response guidance; involve qualified forensic support when the scope or evidence warrants it.

How should affected patients and regulators be notified?

First determine whether the records involved are PHI, whether the information was unsecured, which individuals may be affected, and whether an impermissible use or disclosure occurred. Under HIPAA, an impermissible use or disclosure of unsecured PHI is generally presumed to be a breach unless an applicable exception applies or the organization documents a risk assessment demonstrating a low probability that the PHI was compromised. The required assessment considers the nature and extent of the PHI, who received or used it, whether it was actually acquired or viewed, and how the risk was mitigated. Breach Notification Rule information and risk-assessment factors are explained by HHS.

If HIPAA notification is required, the covered entity must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery. The notice should explain what happened, the types of information involved, steps individuals can take, the organization’s response, and how to get more information. A breach affecting 500 or more individuals must also be reported to the HHS Secretary without unreasonable delay and within 60 days; for fewer than 500 individuals, the report is due within 60 days after the end of the calendar year in which the breach was discovered. A breach affecting more than 500 residents of a state or jurisdiction also requires notice to prominent media outlets serving that area. See HHS’s notification requirements.

Coordinate the decision and communications with privacy, security, and legal leadership. HIPAA may not be the only applicable obligation: check relevant state laws, contracts, and other rules for the organization and records involved. A business associate must notify the covered entity as required by the Breach Notification Rule and its agreement; the parties should coordinate responsibilities and timing.

What response limitations apply when the incident scope is unclear?

Early in an investigation, you may not know whether a link was opened, whether credentials were used, which records were reachable, or whether information was viewed or copied. Distinguish confirmed facts from assumptions, state what evidence is missing, and update the scope as logs and vendor information become available. Do not equate “no confirmed access” with proof that no access occurred.

Uncertainty does not remove the need for prompt investigation, documentation, and escalation. It also should not be treated as an automatic reason to delay a required notice; involve privacy and legal leads promptly to assess discovery dates, applicable requirements, and any updates needed as facts develop. HIPAA-specific requirements apply to covered entities and business associates and to breaches of unsecured PHI, so assess the organization’s role and the information involved rather than assuming every eligibility record is covered by HIPAA.

In summary, report suspected smishing quickly, contain compromised access, preserve evidence, examine relevant logs, and document decisions. Use the available facts to assess exposure and meet any applicable notification obligations.

FAQs

What should staff do if they clicked a smishing link?

Report it immediately to IT or security, explain whether you entered information or approved a sign-in, and follow instructions to secure your account and device. Don’t revisit the link, delete evidence, or try to investigate it yourself.

How can an organization determine whether eligibility records were accessed?

Review identity, email, application, database, endpoint, and network logs for suspicious sign-ins, searches, record views, exports, and account changes. Compare findings with the employee’s account and normal activity, and document gaps in the available logs. No suspicious log entry is not, by itself, proof that records were not accessed.

When does a smishing incident involving patient data require breach notification?

A smishing incident does not automatically require HIPAA breach notification. If it involves an impermissible use or disclosure of unsecured PHI, the organization must determine whether an exception applies or document a HIPAA breach risk assessment demonstrating a low probability that the PHI was compromised. If notification is required, applicable HIPAA deadlines and notice requirements apply; state law or contract obligations may also apply. HHS provides the HIPAA breach assessment and notification rules.

How can staff verify messages claiming to concern sliding fee eligibility?

Don’t use the message’s links, phone numbers, or reply function. Contact the organization through a known internal directory, official website, or previously verified phone number, and ask the appropriate department to confirm the request. Report suspicious messages through the organization’s approved security channel.