Your Patients Could Be Getting Fake Texts From Your Portal. Here’s What Your Front Desk Needs To Know.

In late August, patients across Pennsylvania started getting texts and emails that looked like they came straight from MyChart: a new test result waiting, an unpaid balance, even a free “Medicare Kit.” Some messages claimed a secure message was sitting unread in the patient’s account. One version had a button labeled “Unlock Full Report & See Diagnosis” that, if clicked, downloaded a program straight onto the patient’s computer. Penn Medicine confirmed the scam was spreading nationwide, and Pennsylvania’s Attorney General issued a public warning days later, urging patients to stop clicking links in unexpected portal messages altogether.

This isn’t really a MyChart problem. Any practice that uses a patient portal, which is nearly every specialty practice today, is a target for the exact same trick. Scammers don’t need to break into your systems. They just need your practice’s name and portal branding, both of which are public, to convince a patient to hand over a password or click a malicious link. And when a patient gets confused or scared by one of these messages, they don’t call IT. They call your front desk, usually mid-morning, usually more than once, and usually asking whether the practice really is sending them a bill or a “free kit.”

Here’s what to do this week:

• Brief your front desk and phone staff now: if a patient calls asking about a text or email they didn’t expect, don’t dismiss it as spam. Log it and forward it to whoever manages your IT security.
• Send patients one clear message: your practice will never ask them to click a link for test results, payment, or a free kit. Real portal notifications only ever ask them to log into the app or website directly.
• Confirm with your IT provider that your outbound patient communications, appointment reminders, billing notices, can’t be easily spoofed, and that someone is actually watching for reports like this one.
• If your practice doesn’t have a documented process for who patients should call when something looks off, make that this week’s project.

Practices with three or more locations and shared front-desk protocols are exactly where this kind of scam does the most damage, because one confused patient message can spread across every site in a day. Front-desk staff at each location need the same script and the same escalation path, not three different answers depending on who picks up the phone. A five-minute team huddle this week beats weeks of cleanup later, and it costs you nothing but the time to hold it.

If you want to ensure that your practice hasn’t fallen to this scam, book a free call with TST at https://mysolutionsteam.com/contact-us. We work nationwide with specialty healthcare practices, oral surgery, ENT, OBGYN, dermatology, general surgery, orthopedics, and more, to prevent issues like this.