Health systems warn of phishing scams using Epic’s MyChart name and logo

Health systems across the country are warning patients about an increase in phishing scams involving Epic’s MyChart patient portal.

Epic’s VP of research and development, Trevor Berceau, warned in July that the company has seen an “uptick in scammers trying to trick patients by using the MyChart name or logo to make emails, text messages, phone calls, and websites look official.” As of Aug. 27, 41 health systems have warned patients about the scams, according to Becker’s.

Berceau said in a statement posted to Epic’s website that the increase in phishing attempts are “due to scammers taking advantage of the popularity of the MyChart brand rather than any security concern,” and told users they could keep using the portal as normal. The company declined to comment further on the matter.

What the scams entail. Epic has posted warnings on its website about two separate scams.

In the first type, patients receive an email appearing to be from MyChart that tells them their recent test results are ready and has a button to sign in to the patient portal. If patients click that button, though, it goes to a fake sign-in page asking for their email and password. The page then takes them to a fake version of MyChart’s website with an urgent message stating an “‘AI-powered review’ found critical patterns in your blood work that need immediate attention,” according to the warning.

To see the fake results, the website directs patients through a human verification check, which then installs malware on their device.

Epic said it saw another version of this scam in August, in which the fake site showed patients a fake chart of alarming lab values with some results blacked out. A button tells them to unlock their full report to see the blacked-out results and their diagnosis.

The second scam involves emails informing patients they’ve won a free “Medicare kit” with $149 worth of medical supplies. If patients click to claim their kit, it takes them to a page with the MyChart logo claiming more than $300,000 in MyChart products have been given away. It then asks patients to complete a short survey about their experience with the patient portal, and says they must complete the survey within six minutes.

At the final step, the fake site tells patients they have to pay a shipping fee for the kit and asks them to input their payment information as well as private information such as their email address, phone number, and mailing address.

Epic offered a number of tips to help patients avoid falling prey to the phishing scams, such as checking the sender’s email address and website URLs for misspellings or extra words. The company also said it doesn’t run giveaways, so any emails suggesting so are most likely fake.

The American Hospital Association posted a warning on August 24 about the phishing attempts, advising hospitals to contact the organization’s cybersecurity experts for more information.