Email security for medical practices: what attackers want and how to stop them

A medical practice's email reaches further than its inbox. The same sign-in often opens the patient portal, shared files with referral partners and, through password resets, the EHR, clearinghouse and payer accounts. This guide covers the email threats that matter most to physician practices and clinics, what HHS and the FBI have published about them, and a checklist a practice manager can work through with their IT support.

It doesn't repeat the rule text. For what HIPAA itself says about email, encryption and business associates, read HIPAA email security requirements. If you run a dental office, email security for dental practices covers that setting. This is general information, not legal advice; ask your compliance adviser or counsel how the rules apply to your practice.

Why are medical practices targeted by email attacks?

Medical practices are targeted because one phished staff mailbox can expose thousands of patient records and give criminals a path to the practice's insurance payments. Both outcomes are valuable, and small practices often have no one watching sign-ins.

HHS's Office for Civil Rights (OCR) sees the results. In April 2025 it settled with PIH Health, a California health care network, after a June 2019 phishing attack "compromised forty-five of its employees' email accounts, resulting in the breach of 189,763 individuals' unsecured ePHI." The exposed data included names, Social Security numbers, diagnoses, lab results, medications and claims information. ePHI means electronic protected health information. OCR's acting director said, "Hacking is one of the most common types of large breaches reported to OCR every year" (HHS OCR).

The FBI's 2025 IC3 report also says the ten ransomware variants most reported to it most affected three critical infrastructure sectors, one of them Healthcare and Public Health. Email is a common way in.

What email threats do medical practices face?

Medical practices face general phishing plus lures built around billing, referrals and the portals clinicians and staff use every day. The table lists the common ones.

Diverted insurance and payer payments

Payment diversion is the most direct way email fraud costs a practice money. In a September 2022 Private Industry Notification, the FBI said criminals were "compromising user login credentials of healthcare payment processors and diverting payments to accounts controlled by the cyber criminals." In one April 2022 case, a criminal "posing as an employee" changed ACH instructions at a payment processing vendor and diverted about $840,000. In another, stolen credentials were used to change a hospital's direct deposit details, a $3.1 million loss (FBI PIN 20220914-001). ACH is the US bank transfer network most payers use for reimbursements.

The FBI listed warning signs worth giving to your billing team:

• phishing emails aimed at financial staff,
• "unwarranted changes in email exchange server configuration and custom rules for specific accounts,"
• "requests for employees to reset both passwords and 2FA phone numbers within a short timeframe," and
• employees locked out of payment processor accounts after failed password recovery attempts.

In June 2024 the FBI and HHS issued a joint advisory on a social engineering campaign in which criminals used phishing, and calls to IT help desks posing as employees, to steal login credentials from healthcare organizations and divert ACH payments to accounts they control (FBI and HHS advisory). The defense is procedural: no change to a remittance bank account without a call to a number you already have and a second person's approval.

Phished mailboxes and HIPAA breaches

A phished mailbox is the threat most likely to turn into a reportable breach. Staff email holds referral letters, lab results, scheduling requests and insurance correspondence, often going back years. In the PIH case, OCR's findings included a failure to carry out an accurate and thorough risk analysis and a failure to notify patients, HHS and the media "within 60 days of its discovery." PIH paid $600,000 and agreed to two years of OCR monitoring (HHS OCR).

After a takeover, attackers usually add rules that forward or hide mail. Our guides to malicious inbox rules and signs your email account is compromised show how to check.

Referral, lab and fax lures

Practices receive attachments from strangers all day, which is exactly what phishing needs. A fake "patient referral" or "fax received" email with a PDF, HTML file or link to a sign-in page looks routine to the front desk. Here is an example of a message to report rather than open:

Example: "New patient referral from Dr. A. Patel. 3 pages. Click below to view the secure fax document. This link expires in 24 hours."

Accept referrals through the systems you already use, such as your EHR's referral inbox or your fax service, and call the sending office if a referral arrives any other way. See PDF phishing attachments and HTML attachment phishing.

What does HHS recommend for email in a medical practice?

HHS's 405(d) program, which publishes cybersecurity guidance for the health sector, makes "Email Protection Systems" the first practice in its Technical Volume 1 for small healthcare organizations (2023 edition). OCR adds its own list in its settlement announcements. Together they look like this:

The 405(d) document also suggests checking links by hovering before clicking and watching for misspelled sender domains, such as AMCE.com for ACME.com. It notes that CISA offers free phishing simulation services for organizations with limited budgets. For how to set up training, see email security awareness training.

Can a medical practice email patients?

Yes. HHS says the HIPAA Privacy Rule allows providers to communicate with patients by email if they apply reasonable safeguards, and that a patient may choose unencrypted email after being told of the risks (HHS FAQ). In practice, many practices keep clinical messages in the patient portal and use email for reminders and notices. Whatever you choose, write it down and train staff on it. The HIPAA email guide covers encryption and business associate agreements, and email encryption types for business explains the options.

What should a practice do when a staff mailbox is phished?

Work through these steps in order, and bring in your compliance adviser early:

1. Lock the account. Reset the password, sign out every session, review MFA methods and remove any rules or forwarding the user didn't create. Our after clicking a phishing link guide covers the first hour.
2. Check payment accounts. Confirm no payer, processor, bank or payroll details were changed, and call your bank if they were.
3. Find out what was exposed. Use your platform's audit log to see what the attacker accessed, and list the patients whose information was in the mailbox.
4. Decide on notice with your adviser. HIPAA's Breach Notification Rule generally presumes a breach unless a documented risk assessment shows a low probability of compromise; see the HIPAA guide. Track the 60-day clock from discovery.
5. Remove the phish everywhere. Search other mailboxes for the same message and delete it.
6. Report fraud. If money moved, file at ic3.gov.
7. Fix the cause and record the lessons in your risk analysis, as OCR recommends.

Is Microsoft 365 or Google Workspace protection enough for a medical practice?

For many small practices, Microsoft 365 or Google Workspace set up properly is a reasonable baseline. Both filter spam and malware and support MFA, external tagging and encryption options. Start with Microsoft 365 preset security policies or Google Workspace advanced phishing and malware protection.

An MX-level filter adds a separate checkpoint. MX-level filtering means your domain's MX records point to a filtering service that checks mail before your platform delivers it. It helps when phishing keeps reaching the front desk, when staff should release held referrals from their own quarantine digest, and when you want risky attachment types and Office macros blocked without writing rules. Before patient email flows through any filter, settle the business associate agreement question with the provider and your adviser. Our healthcare practices page explains how iBlockSpam handles that.

Medical practice email security checklist

1. Turn on MFA for every mailbox and turn off IMAP and POP3 unless a device truly needs them.
2. Give each person a unique account; disable leavers the day they go.
3. Block automatic forwarding to personal email addresses; see Microsoft 365 outbound spam policy or disable automatic forwarding in Google Workspace.
4. Require a call to a known number and two-person approval for any payer, processor, vendor or payroll bank change.
5. Tag external mail and accept referrals only through known systems.
6. Include every mailbox and forwarding path in your HIPAA risk analysis, and record your encryption decision.
7. Keep mailbox audit logging on and review sign-ins and rules monthly.
8. Publish SPF, DKIM and DMARC, including reminder and statement services; see DMARC from none to reject.
9. Run short phishing simulations, with extra attention for billing staff.
10. Write down who to call after an incident: IT support, your compliance adviser, your insurer and your bank.

Next steps

• Run the free Email Health Check on your practice's domain to see your MX, SPF and DMARC setup.
• Give your billing team the FBI's warning signs list above and the two-person rule for bank changes.
• Read HIPAA email security requirements before changing how patient information moves by email.
• If you want an inbound filtering layer staff can manage from a digest email, see email protection for medical and dental practices. Pricing is per domain, so adding a provider doesn't change the bill.

More threat guides are in our phishing and threats topic.