Step-by-Step Phishing Attack Incident Response Checklist for LASIK Centers

Phishing remains the most common email phishing vector targeting specialty practices that handle protected health information (PHI). This step-by-step phishing attack incident response checklist is tailored for LASIK centers so you can act quickly, protect patients, and maintain strong cybersecurity incident handling from detection through regulatory compliance reporting.

Use these actions to minimize downtime, preserve forensic evidence, and meet PHI breach notification obligations if required.

Initial Detection

Red flags to watch immediately

• Unexpected messages requesting wire transfers, login verification, or updated insurance details, especially if “From” names look right but domains are slightly altered.
• Unusual sign-in alerts (impossible travel, atypical locations, or failed MFA prompts) and sudden spikes in outbound email.
• New or hidden mailbox rules (auto-forward to external addresses, “mark as read,” or “delete”) and unfamiliar OAuth app consents.
• Patient portal or EHR audit anomalies, such as mass chart access, large exports, or after-hours lookups.

First 15-minute actions

1. Stop interacting with the suspicious email or site. If you clicked, disconnect the device from the network (wired and Wi‑Fi); do not power it off.
2. Preserve evidence: save the email as a file with full headers, capture screenshots, record exact timestamps, and note who received it. This supports forensic evidence preservation.
3. Quarantine the message in your secure “phishing” mailbox; do not forward it to colleagues.
4. Open an incident ticket and move to Notification Procedures.

Notification Procedures

Who to notify within the first hour

• Practice leadership (administrator/medical director) and your designated incident response lead.
• IT/security team or managed service provider (MSP) to begin containment and malicious IP blocking.
• Compliance officer and legal counsel to oversee PHI risk assessment and regulatory strategy.
• Cyber insurance carrier, if applicable, to align on panel forensics and approved vendors.
• Business associates affected (EHR, billing, scheduling, call center) if their systems or data may be involved.

What details to include

• Who, what, when, where: recipients, sender domain, time received, links clicked, attachments opened, and any credential prompts.
• Systems involved (email, EHR, file shares, endpoint), current impact to operations, and immediate safety steps already taken.
• Initial scope hypothesis and any indicators of compromise (IOCs) collected so far.

Investigation Process

Define the attack path and scope

Confirm the email phishing vector, identify whether credentials were harvested, and determine if the attacker accessed mailboxes, EHR records, or file repositories. Build a minute-by-minute timeline from lure delivery to user actions and system responses.

Collect and preserve key artifacts

• Suspicious email (.eml/.msg), full headers, URLs, attachments, and file hashes.
• Identity logs (IdP/M365/Google): sign-ins, MFA approvals, session tokens, conditional access results.
• Mailbox audits: rule changes, external forwarding, Send-As/Send-on-Behalf activity, OAuth grants.
• Endpoint telemetry (EDR/AV): alerts, executed processes, network connections, persistence artifacts.
• Network, firewall, and DNS logs to enumerate domains, URLs, and IPs for subsequent malicious IP blocking.
• EHR and portal audit logs: user, patient records touched, exports/downloads, and timestamps.

Assess PHI exposure risk

Evaluate whether PHI was viewed, acquired, exfiltrated, or merely targeted. Consider the nature of PHI, the unauthorized party involved, whether data was actually accessed, and mitigation performed—inputs that drive PHI breach notification decisions.

Containment Measures

Immediate containment checklist

1. Isolate affected endpoints from the network; keep them powered for memory and disk analysis.
2. Disable or suspend compromised accounts; force password resets and MFA re-registration; revoke refresh tokens and active sessions.
3. Remove malicious mailbox rules, connectors, and unauthorized OAuth app consents; disable external auto-forwarding.
4. Block IOCs: implement malicious IP blocking, domain/URL blocks, and denylists across email security, firewalls, EDR, and DNS filtering.
5. Search-and-purge the phishing email from all mailboxes using your email security or admin center.
6. Temporarily raise authentication security (disable legacy auth, require MFA for all, enforce conditional access for risky logins).
7. Segment or restrict access to EHR, billing, and file shares if privilege misuse is suspected.
8. Notify potentially affected business associates to prevent propagation across integrated systems.

Eradication Steps

Remove footholds and close vulnerabilities

• Run full EDR/AV scans; remediate malware, scripts, persistence tasks, and scheduled jobs.
• Reimage or restore compromised endpoints from a known-good baseline where integrity is uncertain.
• Audit and purge unauthorized OAuth apps, API keys, and service principals; rotate credentials and app secrets.
• Execute security patch management across OS, browsers, email clients, and plugins to eliminate exploited flaws.
• Harden email and identity: enforce MFA everywhere, enable modern auth only, and implement robust anti-phish policies, attachment sandboxing, and link protection.

Recovery Actions

Restore operations safely

• Gradually reconnect cleaned systems, validate logins and email flow, and confirm EHR/billing access with least privilege.
• Monitor high-fidelity detections (impossible travel, new inbox rules, mass downloads) for at least 30 days.
• Run targeted user training focused on the observed lure and tactics to reduce repeat risk.

Patient communications and PHI breach notification

If your risk analysis indicates PHI was compromised, prepare notifications “without unreasonable delay” and no later than 60 calendar days after discovery. For incidents affecting 500 or more individuals in a state or jurisdiction, notify the Department of Health and Human Services (HHS) and, where required, prominent media within 60 days; for fewer than 500 individuals, log the breach and report to HHS no later than 60 days after the end of the calendar year. State laws may impose additional or shorter deadlines—coordinate with counsel and compliance.

Include what happened, the types of PHI involved, steps you took, recommended protections for patients, and your contact details. Document all decisions that led to notification or non-notification.

Documentation and Reporting

Create a complete incident record

• Chronology: detection, decisions, actions, and recovery milestones with exact timestamps.
• Evidence repository: preserved emails, headers, logs, IOCs, forensic images, and analytic notes supporting forensic evidence preservation.
• Scope and impact: systems, accounts, PHI types, and number of individuals potentially affected.
• Root cause and corrective actions: controls added, process changes, and follow-up testing plans.

Regulatory compliance reporting

• Maintain your breach log and complete regulatory compliance reporting per federal and applicable state requirements.
• For breaches affecting 500+ individuals in a state/jurisdiction: report to HHS and notify media within 60 days of discovery.
• For breaches affecting fewer than 500 individuals: submit to HHS no later than 60 days after the end of the calendar year and retain records for at least six years.
• Notify relevant business associates and, if required, state authorities or licensing boards.

Summary and next steps

By detecting fast, containing decisively, executing eradication and security patch management, and documenting thoroughly, your LASIK center can reduce impact, meet PHI breach notification duties, and strengthen resilience. Use this checklist to standardize response and shorten the path from incident to recovery.

FAQs

How do LASIK centers identify a phishing attack?

Look for sender/domain mismatches, urgent financial or credential requests, unexpected attachments, and login pages that ask for MFA codes. Monitor for inbox rule changes, impossible travel sign-ins, and spikes in outbound email—strong signals of an active email phishing vector.

What steps should be taken to contain a phishing incident?

Isolate affected devices, disable compromised accounts, force password and MFA resets, remove malicious inbox rules, revoke tokens, and implement malicious IP blocking and domain/URL denylisting. Then purge the lure from all mailboxes and raise authentication requirements temporarily.

When must patients be notified of a PHI breach?

Notify affected individuals without unreasonable delay and no later than 60 days after discovery when your risk analysis shows PHI was compromised. Breaches involving 500+ individuals in a state/jurisdiction also require timely notification to HHS and, where required, the media; smaller breaches are logged and reported to HHS no later than 60 days after the end of the calendar year. Check state rules for additional timelines.

How is post-incident documentation handled?

Maintain a detailed timeline, preserved evidence, scope and impact analysis, decision rationale, and corrective actions. Store records securely for regulatory compliance reporting and retention requirements, and complete an after-action review to close gaps and update the incident response playbook.