Spear Phishing Incident Response Guide for Rehabilitation Psychology Practices

A spear phishing message is tailored to trick a specific person into clicking a link, opening an attachment, sharing information, or approving a request. In a rehabilitation psychology practice, a successful attack could expose patient information, compromise clinical systems, or disrupt care.

HIPAA applicability depends on the practice’s role and activities: health care providers that conduct certain transactions electronically are covered entities, and business associates have their own obligations. The HHS HIPAA Security Rule summary explains who the rule covers and requires regulated entities to respond to and document suspected or known security incidents. This guide is practical information, not legal advice.

What should staff do immediately after a suspected spear phishing incident?

Stop interacting with the message and report it promptly. Do not reply, click links, open attachments, scan QR codes, or use an unsubscribe link. Follow the practice’s reporting process, such as its approved report-phishing button or contacting the designated supervisor, privacy officer, or IT/security lead. CISA likewise advises people to report suspicious messages and avoid replying or clicking links or attachments in its phishing guidance.

• If you clicked, opened a file, entered credentials, approved a sign-in prompt, or sent patient or financial information, tell the response lead exactly what happened and when. Reporting quickly helps the practice contain access and investigate.
• Preserve the message and any related details—such as the sender, subject, time received, link destination, and attachment name—using the practice’s approved process. Do not forward it to personal accounts or delete it before asking the response lead what to do.
• Do not investigate by revisiting the suspicious link or opening the attachment. Let the designated technical responder examine the message safely.
• If the incident could affect appointments or clinical systems, notify the appropriate practice lead so staff can use approved continuity procedures while protecting patient information.

The HIPAA Security Rule requires regulated entities to identify and respond to suspected or known security incidents, mitigate harmful effects where practicable, and document incidents and their outcomes. See the HHS summary of the HIPAA Security Rule.

How should a rehabilitation psychology practice detect and analyze a phishing incident?

Start by establishing what happened, which accounts or devices may be involved, and whether the attacker gained access or caused a change. Record the report time and build a timeline from the message’s arrival through each known click, sign-in, file opening, or disclosure.

With qualified IT or incident-response support, review the suspicious email and relevant records, including email sign-in and audit logs, unusual inbox rules, sent and deleted messages, account recovery changes, multifactor authentication prompts, endpoint alerts, activity in the electronic health record or other systems containing electronic protected health information (ePHI). Check whether similar messages reached other staff and whether a compromised account sent messages onward.

Preserve relevant records before they expire or are overwritten. This may include the original message and headers, security logs, endpoint alerts, sign-in records, and records from cloud or technology vendors. HHS identifies collecting and preserving incident-related data, such as log files and other artifacts, as part of response activities in its cybersecurity guidance.

Assess the incident’s scope across confidentiality, integrity, and availability: determine whether information may have been viewed or taken, whether records or settings were altered, and whether clinical systems or services were disrupted. Separate confirmed facts from unanswered questions, and keep investigating if the available evidence does not yet establish whether access occurred. NIST’s incident response recommendations describe detection, response, and recovery as part of an organization-wide cybersecurity risk-management process.

How can affected accounts and devices be contained and secured?

Containment should limit further access while accounting for patient-care needs and preservation of evidence. The response lead or qualified IT support should decide which accounts, devices, sessions, or systems to restrict and coordinate actions so staff do not unintentionally alert an attacker or interrupt essential services.

• Secure potentially compromised accounts: From a trusted device, reset affected passwords, revoke active sessions and tokens, check recovery settings and inbox rules, and review any connected apps or delegated access. If credentials were reused, assess and secure other accounts that share them.
• Use multifactor authentication: Enable or strengthen it for email, remote access, and accounts that reach clinical or administrative systems, where supported. Treat MFA as a risk-reduction measure and assess appropriate safeguards for the practice’s environment; do not assume that HIPAA prescribes one universal MFA configuration.
• Consider endpoint isolation: If a device may have executed malware or is showing suspicious activity, contact IT promptly about disconnecting it from Wi-Fi or the wired network. Coordinate isolation with the incident responder, especially if the device supports care or contains evidence.
• Coordinate with vendors: If email, EHR, cloud storage, or another service may be affected, contact the provider through a verified channel and follow the applicable business associate agreement (BAA) and incident procedures.

The HHS explanation of addressable Security Rule specifications notes that practices must evaluate whether such measures are reasonable and appropriate in their environment, document their decisions, and use an appropriate alternative when warranted. For suspected malware, CISA recommends isolating affected systems as part of its incident response guidance; technical responders should also consider how containment choices affect evidence and clinical operations.

How should the practice eradicate threats and restore operations?

After containment, determine how the attacker gained access and remove the access path—not just the visible email or file. Depending on the findings, malware remediation may include removing malicious files or persistence mechanisms, revoking unauthorized app access, correcting inbox rules, patching vulnerable software, and securing compromised credentials or systems. Use qualified technical support if the practice cannot reliably verify that a device or account is clean.

Restore affected systems only from backups or configurations that have been checked for integrity and are believed to be clean. Bring systems back in a controlled manner, verify that security protections and access controls work, and monitor for renewed suspicious activity. Avoid restoring a compromised configuration or reconnecting an unverified device simply to resume work quickly.

If systems needed for treatment or scheduling are unavailable, use the practice’s contingency procedures and approved alternate workflows to protect ePHI and continue critical operations. HHS describes contingency planning, data backup, restoration, and continued protection of ePHI during emergency operations in its HIPAA Security Rule summary. NIST’s incident response publication also provides a framework for coordinating response and recovery.

How should the practice assess possible exposure of protected health information?

A suspicious email or a compromised account does not by itself establish that a reportable breach occurred. The practice should determine whether there was an impermissible use or disclosure of protected health information (PHI), whether the information was unsecured, and whether an exception applies. Under HHS’s Breach Notification Rule guidance, an impermissible use or disclosure of PHI is generally presumed to be a breach unless the covered entity or business associate demonstrates a low probability that the PHI was compromised through a risk assessment.

For that assessment, consider at least these four factors:

• The nature and extent of the PHI involved, including identifiers and the likelihood of re-identification.
• The person who used the PHI or received the disclosure without authorization.
• Whether the PHI was actually acquired or viewed.
• The extent to which the risk to the PHI was mitigated.

Document the evidence, uncertainties, reasoning, and decision. If the incident involves unsecured PHI and constitutes a breach, notification obligations may apply. Under the federal HIPAA rule, covered entities must notify affected individuals without unreasonable delay and no later than 60 days after discovery of a breach. Breaches affecting 500 or more individuals require notice to HHS within that timeframe; breaches affecting fewer than 500 may be reported to HHS annually, no later than 60 days after the end of the calendar year in which they were discovered. Media notice is required when a breach affects more than 500 residents of a state or jurisdiction. A business associate must notify the covered entity after discovering a breach, without unreasonable delay and no later than 60 days; the BAA may set a shorter reporting deadline. See the HHS breach notification requirements.

Consult the practice’s privacy officer, legal counsel, and relevant business associates when deciding whether notification is required and who will provide it. State laws, contractual terms, or other requirements may also apply, so do not treat the federal HIPAA timeline as the only deadline to review.

What should an incident response plan include?

A usable plan should be written for the practice’s size, systems, staffing, and clinical workflows. It should identify who leads the response, who can authorize urgent containment steps, and how staff report concerns—including when the usual email or network tools are unavailable.

• Roles and contact details for practice leadership, IT or security support, the privacy officer, legal counsel, insurers, and relevant vendors or business associates.
• Clear procedures for reporting suspicious messages and for escalating suspected account compromise, malware, possible PHI exposure, or service disruption.
• Steps for detection, security log preservation, account protection, endpoint isolation, malware remediation, recovery, and safe return to normal operations.
• Processes for assessing possible PHI exposure and determining breach notification obligations, including who makes and documents those decisions.
• Continuity procedures for essential clinical and administrative work, along with secure backups and a method to communicate out of band during an incident.
• Staff training and periodic exercises to check whether team members can follow the plan under realistic conditions.

The HIPAA Security Rule requires policies and procedures for responding to security incidents, but it does not prescribe one plan format for every practice. HHS describes the rule as flexible and scalable and requires reasonable and appropriate safeguards based on the entity’s circumstances in its Security Rule summary. NIST’s incident response recommendations can help practices organize preparation, response, and recovery.

How can practices document and review an incident?

Keep a secure incident record that captures the timeline, people and systems involved, evidence collected, containment and recovery actions, communications, and decisions. Record who performed each action and when. Preserve original evidence and note where it is stored and who can access it; avoid altering or broadly sharing files that may contain PHI.

Document the protected health information breach assessment, including the available facts, the four assessment factors, any exception considered, the decision-maker, and the rationale for notification or non-notification. If notices are required, retain records showing what was sent and when. HHS states that covered entities and business associates must be able to demonstrate that required notices were made or document why notice was not required in its Breach Notification Rule guidance.

After immediate response, review how the message reached staff, whether controls or reporting steps worked, and what needs improvement. Assign owners and deadlines for corrective actions, update procedures and training, and reassess relevant security risks. The HIPAA Security Rule requires regulated entities to document security incidents and their outcomes, as summarized by HHS.

In short, report suspected spear phishing quickly, investigate and preserve evidence, contain access carefully, assess any PHI exposure, and document decisions and lessons learned. A practiced response plan helps protect patients while the practice restores safe operations.

FAQs.

Should staff reply to a suspected spear phishing email?

No. Do not reply, click links, open attachments, or use an unsubscribe link. Report the message through the practice’s approved channel and preserve it according to internal instructions. CISA advises reporting suspicious messages and not replying or clicking links or attachments in its phishing guidance.

What should a practice do if an employee entered their credentials?

The employee should notify the practice’s response lead immediately and explain what information they entered and when. From a trusted device, qualified IT support should secure the account, reset the password, revoke active sessions or tokens, review recovery settings and account activity, and check for unauthorized inbox rules or app access. Review other accounts if the same password was reused, and assess whether ePHI may have been accessed.

When may a phishing incident require patient notification?

Patient notification may be required if the investigation finds a breach of unsecured PHI and no applicable exception or documented low-probability-of-compromise assessment removes the notification requirement. The practice should assess the facts and follow applicable federal and state requirements; a suspicious message alone does not establish that patient notice is required. See the HHS Breach Notification Rule guidance.

Should a potentially infected device be disconnected from the network?

If malware may have run or the device is behaving suspiciously, contact IT or the incident responder promptly about isolating it from Wi-Fi or the wired network to limit further activity. The responder should weigh containment, evidence preservation, and clinical operations. Do not power off, wipe, or run cleanup tools unless the responder directs you; those actions may affect evidence. CISA discusses isolating affected systems and preserving evidence in its incident response guidance.