Spear Phishing Incident Response Guide for Oncology Information System Vendors

What should users do after receiving or interacting with a spear phishing message?

If you receive a suspicious message, don’t click links, open attachments, reply, or use an unsubscribe link. Report it through your organization’s approved phishing-reporting tool or help desk. Follow the security team’s instructions on whether to delete or quarantine it; CISA’s phishing guidance recommends reporting suspicious messages and deleting them when appropriate.

If you clicked a link, opened an attachment, scanned a QR code, approved an unexpected sign-in request, or entered credentials, report that promptly—even if nothing unusual happened afterward. Include when it happened, which device and account you used, what information you entered, and any prompts or downloads you noticed. Don’t send passwords or patient information in an ordinary email.

Keep the original message available for responders. Use the approved reporting method to preserve or submit it, including its headers if possible; don’t simply forward it to coworkers or permanently delete it before reporting. If you entered credentials, contact the service desk from a trusted channel and use its instructions to secure the account.

How should teams coordinate incident response while maintaining care continuity?

Assign an incident lead and bring together security, identity and email administrators, the oncology-system vendor, privacy and legal teams, and clinical operations leaders. Include the people responsible for the affected workflows, such as oncology nursing, pharmacy, radiation oncology, and medical physics. Use an approved, unaffected communications channel and keep a shared timeline of decisions, actions, and service status.

Coordinate containment with clinical leaders before disrupting systems that support treatment. Identify which functions are affected, what safe alternatives are available, who can authorize downtime procedures, and how staff will receive timely updates. If an affected vendor is a business associate, follow the applicable business associate agreement (BAA) and report security incidents as required; HHS guidance for cloud service providers explains the HIPAA incident-reporting obligation and the role of the BAA.

Keep technical containment and clinical decisions connected but distinct: security responders determine what can safely be isolated, while authorized care teams decide how to maintain treatment. HIPAA’s Security Rule calls for incident-response procedures and contingency plans that support emergency-mode operations and continued critical business processes, as summarized in HHS’s HIPAA Security Rule guidance.

How can suspected accounts and endpoints be contained safely?

Work with identity administrators to secure suspected accounts. Depending on the evidence and system capabilities, actions may include resetting credentials through a trusted process, requiring fresh multifactor authentication, revoking active sessions and refresh tokens through identity provider session revocation, and reviewing recovery methods, delegated access, and connected applications. Confirm that response actions do not prevent authorized clinicians from accessing approved alternatives.

Conduct a mailbox forwarding rule investigation for suspicious forwarding, inbox rules, delegates, and recently granted application permissions. Review the same user’s sign-in activity and linked accounts for signs of further access. Preserve relevant settings and audit records before changing them when feasible, while prioritizing prompt containment of ongoing unauthorized access.

Use endpoint detection and response or network controls to isolate a suspected device when incident responders and clinical operations determine it is safe. Don’t casually power it off, wipe it, or return it to service before responders consider evidence preservation and patient-care dependencies. HHS advises activating incident-response procedures and isolating infected systems when appropriate; its ransomware and HIPAA guidance also emphasizes assessing scope, containing impact, and recovering systems.

What evidence should responders preserve and correlate?

Preserve the original message, full email headers, attachments or links, report time, and the user’s account of what happened. Collect relevant identity-provider sign-ins, multifactor-authentication events, session and token activity, mailbox rules, email message traces, endpoint alerts, remote-access records, network and DNS activity, and administrator actions. Secure copies of logs promptly so routine retention or rotation does not erase useful records.

Build a shared timeline that aligns timestamps and time zones across systems. Perform EHR audit log correlation with identity, email, endpoint, and network events to determine which accounts accessed which records, from what systems, and whether records were viewed, exported, changed, or deleted. HHS identifies audit controls as a Security Rule requirement for recording and examining activity in systems that contain or use ePHI. For investigation records and evidence, follow your organization’s preservation procedures and the relevant recommendations in NIST SP 800-61 Rev. 3.

Document who collected each item, when and how it was collected, where it is stored, and any actions taken on it. Limit access to evidence that contains protected health information (PHI), and use secure, approved storage. Preserve the integrity and provenance of the incident records so other responders can understand and validate the investigation.

How should teams assess impacts to oncology records and workflows?

Establish the affected time window, accounts, systems, and data stores. Determine whether the intruder accessed or could access patient identities, diagnoses, clinical notes, laboratory results, medication orders, treatment plans, images, scheduling data, or exported files. Distinguish evidence of viewing, acquisition, alteration, deletion, or unavailability; don’t assume that a lack of confirmed downloads proves records were not accessed.

Assess clinical consequences as well as confidentiality. Identify whether teams can reliably see current orders, allergies, treatment status, appointment details, and other information needed for care. Prioritize records and workflows whose uncertainty could affect a treatment decision, and have authorized clinical leaders determine safe next steps.

For a protected health information risk assessment, HIPAA’s breach rule calls for consideration of the PHI involved and re-identification risk, the person who accessed or received it, whether it was actually acquired or viewed, and the extent to which risk was mitigated. HHS describes these factors in its Breach Notification Rule guidance. Document the evidence and reasoning behind the assessment; also evaluate relevant availability and integrity impacts on care workflows.

How can systems and treatment data be validated during recovery?

Restore or return systems to service only through an approved recovery plan. Use known-good sources, verify that security controls are restored, and test interfaces and downstream systems before relying on the recovered data. HIPAA requires covered entities and business associates to implement appropriate security incident procedures; its contingency-planning provisions address backup, restoration, and critical processes during emergency operations. See HHS’s HIPAA Security Rule summary.

Reconcile recovered records against trusted sources and review the changes made during the incident or downtime. For oncology medication order reconciliation, authorized clinicians should confirm relevant orders against approved source documentation, including the intended drug, dose, route, timing, cycle, and any holds or changes. Resolve discrepancies through the organization’s clinical process rather than relying on uncertain or potentially altered records.

For radiation therapy schedule validation, authorized radiation oncology staff and medical physics should verify the planned treatment, delivered fractions, appointments, and relevant plan and machine records against trusted sources before relying on recovered schedules. Validate access permissions, interfaces, and audit logging too. Keep clinical leaders informed about what has and has not been verified, and document approval for resuming affected workflows.

What breach assessment, notification, and response testing steps are required?

First determine which laws and contractual terms apply to the vendor and affected organization. HIPAA applies to covered entities and business associates as defined by the rules; a vendor’s role and BAA matter. A security incident does not automatically mean a reportable breach, but an impermissible use or disclosure of PHI is generally presumed to be a breach unless the organization demonstrates a low probability of compromise under the required risk assessment or an exception applies. Document the conclusion and its supporting evidence.

For reportable breaches of unsecured PHI, covered entities must notify affected individuals without unreasonable delay and no later than 60 days after discovery. A business associate must notify the covered entity without unreasonable delay and no later than 60 days from discovery, although the BAA may require faster reporting. The 60-calendar-day breach notification limit is an outer deadline, not a reason to wait; other reporting duties can also apply. HHS explains the requirements for individuals, business associates, the Secretary, and media in its Breach Notification Rule guidance.

Test the response plan with exercises that involve spear phishing, identity and mailbox containment, vendor-clinic escalation, evidence preservation, downtime operations, and recovery validation. Review whether staff can reach the right responders and whether clinical teams can safely continue or resume workflows. Record gaps, assign corrective actions, and update procedures based on lessons learned. HHS requires periodic evaluation of Security Rule policies and procedures; NIST SP 800-61 Rev. 3 provides current recommendations for integrating incident response into cybersecurity risk management.

In short, report quickly, coordinate containment with care teams, preserve evidence, assess both PHI exposure and clinical-data integrity, validate recovery before resuming workflows, and document breach and notification decisions.

FAQs.

Should a suspected spear phishing email be deleted or preserved?

Report it through your organization’s approved process first, and follow instructions on quarantine or deletion. If you interacted with it or it may relate to an active incident, preserve the original message and headers through a secure reporting method so responders can investigate. Don’t forward it casually or delete it before reporting.

What should staff report if they clicked a link or entered credentials?

Report the time, device, account, message, link or attachment, and any information entered or sign-in prompts approved. Tell the service desk if you downloaded a file, entered a password, approved multifactor authentication, or noticed unexpected activity. Use a trusted channel and follow the organization’s instructions to secure the account.

How can responders isolate an affected device without disrupting patient care?

Coordinate with incident responders and the clinical leader responsible for the affected workflow before isolating it. Use approved endpoint or network controls where appropriate, and confirm a safe alternative for authorized care teams. Preserve evidence before wiping or rebuilding the device, unless immediate clinical or security risks require another action.

How soon must affected individuals be notified after a reportable breach is discovered?

For a reportable breach of unsecured PHI, the covered entity must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery. A business associate must notify the covered entity without unreasonable delay and no later than 60 days from discovery, subject to any faster deadline in its BAA. See HHS’s Breach Notification Rule guidance.