# Email security for medical practices: what attackers want and how to stop them

URL: https://iblockspam.com/blog/email-security-for-medical-practices
Last updated: 2026-11-02
Published: 2026-11-02
Topic: Phishing & threats
Author: iBlockSpam Team

> Email risks for physician practices: payer payment diversion, phished staff mailboxes that become HIPAA breaches, fake portal logins, and what HHS recommends.

## Short answer

Medical practices are targeted because staff mailboxes hold patient data and lead to EHR, clearinghouse and payer portals. The main risks are phished mailboxes that become HIPAA breaches, diverted insurance payments, fake portal logins and ransomware. HHS recommends MFA on email, unique accounts, external tags and phishing training. Add payment call-backs, DMARC and inbound filtering.

A medical practice's email reaches further than its inbox. The same sign-in often opens the patient portal, shared files with referral partners and, through password resets, the EHR, clearinghouse and payer accounts. This guide covers the email threats that matter most to physician practices and clinics, what HHS and the FBI have published about them, and a checklist a practice manager can work through with their IT support.

It doesn't repeat the rule text. For what HIPAA itself says about email, encryption and business associates, read [HIPAA email security requirements](https://iblockspam.com/blog/hipaa-email-security-requirements). If you run a dental office, [email security for dental practices](https://iblockspam.com/blog/email-security-for-dental-practices) covers that setting. This is general information, not legal advice; ask your compliance adviser or counsel how the rules apply to your practice.

## Why are medical practices targeted by email attacks?

Medical practices are targeted because one phished staff mailbox can expose thousands of patient records and give criminals a path to the practice's insurance payments. Both outcomes are valuable, and small practices often have no one watching sign-ins.

HHS's Office for Civil Rights (OCR) sees the results. In April 2025 it settled with PIH Health, a California health care network, after a June 2019 phishing attack "compromised forty-five of its employees' email accounts, resulting in the breach of 189,763 individuals' unsecured ePHI." The exposed data included names, Social Security numbers, diagnoses, lab results, medications and claims information. **ePHI** means electronic protected health information. OCR's acting director said, "Hacking is one of the most common types of large breaches reported to OCR every year" ([HHS OCR](https://www.hhs.gov/press-room/ocr-hipaa-racap-pih.html)).

The FBI's [2025 IC3 report](https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf) also says the ten ransomware variants most reported to it most affected three critical infrastructure sectors, one of them Healthcare and Public Health. Email is a common way in.

## What email threats do medical practices face?

Medical practices face general phishing plus lures built around billing, referrals and the portals clinicians and staff use every day. The table lists the common ones.

| Threat | What arrives | Who it targets | How to check |
|---|---|---|---|
| Payer or processor payment diversion | Phishing or a phone call to change where reimbursements are deposited | Billing, practice manager | Call the payer on a known number; two-person approval |
| Fake portal or EHR sign-in | "Your clearinghouse, payer or EHR password expires today" | Front desk, billers | Open portals from bookmarks only |
| Referral and records lures | "Patient referral", "lab results" or "fax received" attachments | Front desk, referral coordinators | Accept referrals only through known portals or fax systems |
| Mailbox takeover | A stolen password, then hidden forwarding rules | Anyone; physicians and managers most | MFA, sign-in alerts, monthly rule review |
| Vendor and payroll changes | A supplier or staff member "has a new bank" | Practice manager, payroll | Phone a known number before any change |
| Fake version of your practice | Statements or "balance due" emails sent to patients | Your patients | DMARC; tell patients how you bill |

### Diverted insurance and payer payments

Payment diversion is the most direct way email fraud costs a practice money. In a September 2022 Private Industry Notification, the FBI said criminals were "compromising user login credentials of healthcare payment processors and diverting payments to accounts controlled by the cyber criminals." In one April 2022 case, a criminal "posing as an employee" changed ACH instructions at a payment processing vendor and diverted about $840,000. In another, stolen credentials were used to change a hospital's direct deposit details, a $3.1 million loss ([FBI PIN 20220914-001](https://www.ic3.gov/CSA/2022/220914-2.pdf)). **ACH** is the US bank transfer network most payers use for reimbursements.

The FBI listed warning signs worth giving to your billing team:

- phishing emails aimed at financial staff,
- "unwarranted changes in email exchange server configuration and custom rules for specific accounts,"
- "requests for employees to reset both passwords and 2FA phone numbers within a short timeframe," and
- employees locked out of payment processor accounts after failed password recovery attempts.

In June 2024 the FBI and HHS issued a joint advisory on a social engineering campaign in which criminals used phishing, and calls to IT help desks posing as employees, to steal login credentials from healthcare organizations and divert ACH payments to accounts they control ([FBI and HHS advisory](https://www.ic3.gov/CSA/2024/240624.pdf)). The defense is procedural: no change to a remittance bank account without a call to a number you already have and a second person's approval.

### Phished mailboxes and HIPAA breaches

A phished mailbox is the threat most likely to turn into a reportable breach. Staff email holds referral letters, lab results, scheduling requests and insurance correspondence, often going back years. In the PIH case, OCR's findings included a failure to carry out an accurate and thorough risk analysis and a failure to notify patients, HHS and the media "within 60 days of its discovery." PIH paid $600,000 and agreed to two years of OCR monitoring ([HHS OCR](https://www.hhs.gov/press-room/ocr-hipaa-racap-pih.html)).

After a takeover, attackers usually add rules that forward or hide mail. Our guides to [malicious inbox rules](https://iblockspam.com/blog/malicious-inbox-rules-auto-forwarding) and [signs your email account is compromised](https://iblockspam.com/blog/signs-email-account-compromised) show how to check.

### Referral, lab and fax lures

Practices receive attachments from strangers all day, which is exactly what phishing needs. A fake "patient referral" or "fax received" email with a PDF, HTML file or link to a sign-in page looks routine to the front desk. Here is an example of a message to report rather than open:

> Example: "New patient referral from Dr. A. Patel. 3 pages. Click below to view the secure fax document. This link expires in 24 hours."

Accept referrals through the systems you already use, such as your EHR's referral inbox or your fax service, and call the sending office if a referral arrives any other way. See [PDF phishing attachments](https://iblockspam.com/blog/pdf-phishing-attachments) and [HTML attachment phishing](https://iblockspam.com/blog/html-attachment-phishing-html-smuggling).

## What does HHS recommend for email in a medical practice?

HHS's 405(d) program, which publishes cybersecurity guidance for the health sector, makes "Email Protection Systems" the first practice in its [Technical Volume 1 for small healthcare organizations](https://405d.hhs.gov/Documents/tech-vol1-508.pdf) (2023 edition). OCR adds its own list in its settlement announcements. Together they look like this:

| Recommendation | Source | What to do in a practice |
|---|---|---|
| "Deploy multi-factor authentication (MFA) before enabling access to your email system" | 405(d) | MFA on every mailbox, for web and desktop apps |
| IMAP and POP3 "might not support MFA and can leave a back door open" | 405(d) | Turn off legacy protocols unless a device truly needs them |
| Give every employee "a unique user account tied to a unique email address" that isn't shared | 405(d) | No shared front-desk passwords; remove leavers promptly |
| Tag external mail, for example "Stop. Read. Think. This is an External Email." | 405(d) | Turn on external sender warnings |
| Implement an email encryption service or module | 405(d) | Decide when staff must send encrypted |
| Phishing simulations "on at least a monthly basis" | 405(d) | Short monthly tests, extra for billing and managers |
| "Ensure that audit controls are in place to record and examine information system activity" | OCR | Keep mailbox audit logs on and review them |
| "Encrypt ePHI in transit and at rest... when appropriate" | OCR | Record your encryption decision in the risk analysis |
| Identify where ePHI is located and how it "enters, flows through, and leaves" your systems | OCR | List every mailbox, phone and forwarding path that carries patient data |

The 405(d) document also suggests checking links by hovering before clicking and watching for misspelled sender domains, such as `AMCE.com` for `ACME.com`. It notes that CISA offers free phishing simulation services for organizations with limited budgets. For how to set up training, see [email security awareness training](https://iblockspam.com/blog/email-security-awareness-training-small-business).

## Can a medical practice email patients?

Yes. HHS says the HIPAA Privacy Rule allows providers to communicate with patients by email if they apply reasonable safeguards, and that a patient may choose unencrypted email after being told of the risks ([HHS FAQ](https://www.hhs.gov/hipaa/for-professionals/faq/570/does-hipaa-permit-health-care-providers-to-use-email-to-discuss-health-issues-with-patients/index.html)). In practice, many practices keep clinical messages in the patient portal and use email for reminders and notices. Whatever you choose, write it down and train staff on it. The [HIPAA email guide](https://iblockspam.com/blog/hipaa-email-security-requirements) covers encryption and business associate agreements, and [email encryption types for business](https://iblockspam.com/blog/email-encryption-types-for-business) explains the options.

## What should a practice do when a staff mailbox is phished?

Work through these steps in order, and bring in your compliance adviser early:

1. **Lock the account.** Reset the password, sign out every session, review MFA methods and remove any rules or forwarding the user didn't create. Our [after clicking a phishing link guide](https://iblockspam.com/blog/what-to-do-after-clicking-phishing-link) covers the first hour.
2. **Check payment accounts.** Confirm no payer, processor, bank or payroll details were changed, and call your bank if they were.
3. **Find out what was exposed.** Use your platform's audit log to see what the attacker accessed, and list the patients whose information was in the mailbox.
4. **Decide on notice with your adviser.** HIPAA's Breach Notification Rule generally presumes a breach unless a documented risk assessment shows a low probability of compromise; see the [HIPAA guide](https://iblockspam.com/blog/hipaa-email-security-requirements). Track the 60-day clock from discovery.
5. **Remove the phish everywhere.** Search other mailboxes for the same message and delete it.
6. **Report fraud.** If money moved, file at [ic3.gov](https://www.ic3.gov).
7. **Fix the cause** and record the lessons in your risk analysis, as OCR recommends.

## Is Microsoft 365 or Google Workspace protection enough for a medical practice?

For many small practices, Microsoft 365 or Google Workspace set up properly is a reasonable baseline. Both filter spam and malware and support MFA, external tagging and encryption options. Start with [Microsoft 365 preset security policies](https://iblockspam.com/blog/microsoft-365-preset-security-policies) or [Google Workspace advanced phishing and malware protection](https://iblockspam.com/blog/google-workspace-advanced-phishing-malware-protection).

An MX-level filter adds a separate checkpoint. **MX-level filtering** means your domain's MX records point to a filtering service that checks mail before your platform delivers it. It helps when phishing keeps reaching the front desk, when staff should release held referrals from their own quarantine digest, and when you want risky attachment types and Office macros blocked without writing rules. Before patient email flows through any filter, settle the business associate agreement question with the provider and your adviser. Our [healthcare practices page](https://iblockspam.com/solutions/healthcare) explains how iBlockSpam handles that.

## Medical practice email security checklist

1. Turn on MFA for every mailbox and turn off IMAP and POP3 unless a device truly needs them.
2. Give each person a unique account; disable leavers the day they go.
3. Block automatic forwarding to personal email addresses; see [Microsoft 365 outbound spam policy](https://iblockspam.com/blog/microsoft-365-outbound-spam-policy) or [disable automatic forwarding in Google Workspace](https://iblockspam.com/blog/google-workspace-disable-automatic-email-forwarding).
4. Require a call to a known number and two-person approval for any payer, processor, vendor or payroll bank change.
5. Tag external mail and accept referrals only through known systems.
6. Include every mailbox and forwarding path in your HIPAA risk analysis, and record your encryption decision.
7. Keep mailbox audit logging on and review sign-ins and rules monthly.
8. Publish SPF, DKIM and DMARC, including reminder and statement services; see [DMARC from none to reject](https://iblockspam.com/blog/dmarc-none-to-reject-small-business).
9. Run short phishing simulations, with extra attention for billing staff.
10. Write down who to call after an incident: IT support, your compliance adviser, your insurer and your bank.

## Next steps

- Run the free [Email Health Check](https://iblockspam.com/tools/email-health-check) on your practice's domain to see your MX, SPF and DMARC setup.
- Give your billing team the FBI's warning signs list above and the two-person rule for bank changes.
- Read [HIPAA email security requirements](https://iblockspam.com/blog/hipaa-email-security-requirements) before changing how patient information moves by email.
- If you want an inbound filtering layer staff can manage from a digest email, see [email protection for medical and dental practices](https://iblockspam.com/solutions/healthcare). Pricing is per domain, so adding a provider doesn't change the bill.

More threat guides are in our [phishing and threats topic](https://iblockspam.com/blog/topic/threats).

## Frequently asked questions

### What happens if a phishing email compromises a doctor's office mailbox?

Treat it as a possible HIPAA breach. Secure the account, find out what patient information the mailbox held and whether it was accessed, and follow your breach procedure, which includes notice within 60 days of discovery when notice is required. OCR has settled with organizations that skipped an accurate risk analysis. Speak to your compliance adviser or counsel.

### How do criminals steal insurance payments from medical practices?

They phish staff or impersonate employees to get into payer, clearinghouse or payment processor accounts, then change the bank account where reimbursements are deposited. The FBI described one 2022 case where a criminal posing as an employee changed ACH instructions and diverted about $840,000. Require a verified call before any remittance bank change.

### Can physicians forward work email to a personal Gmail account?

It's a poor idea. Forwarding moves patient information into an account the practice doesn't control, can't protect with its own MFA policy and won't see in its audit logs. HHS's 405(d) guidance tells small healthcare organizations to avoid free or consumer email systems. Block automatic external forwarding and give clinicians secure mobile access instead.

### Does HHS recommend phishing simulations for small medical practices?

Yes. HHS's 405(d) Technical Volume 1 for small healthcare organizations says to consider running workforce-wide phishing simulations at least monthly, with extra simulations for higher-risk roles such as leadership, accounts payable and payroll. It also notes that CISA offers free phishing simulation services for organizations with limited budgets.

### Should a medical practice turn off IMAP and POP email access?

Usually, yes, unless a specific device needs it. HHS's 405(d) guidance warns that IMAP and POP3 might not support MFA and can leave a back door open to your mailboxes. Use the vendor's modern apps that enforce MFA, and list any exception in your risk analysis with a plan to remove it.

## Sources

- [HHS OCR: Settles Phishing Attack Breach with Health Care Network for $600,000 (PIH Health, April 23, 2025)](https://www.hhs.gov/press-room/ocr-hipaa-racap-pih.html)
- [HHS 405(d): Technical Volume 1, Cybersecurity Practices for Small Healthcare Organizations (2023 edition)](https://405d.hhs.gov/Documents/tech-vol1-508.pdf)
- [FBI Private Industry Notification 20220914-001: Cyber Criminals Targeting Healthcare Payment Processors (September 14, 2022)](https://www.ic3.gov/CSA/2022/220914-2.pdf)
- [FBI and HHS Joint Cybersecurity Advisory: Social Engineering Tactics Targeting Healthcare and Public Health Entities (June 2024)](https://www.ic3.gov/CSA/2024/240624.pdf)
- [HHS: Does the HIPAA Privacy Rule permit health care providers to use e-mail to discuss health issues and treatment with their patients?](https://www.hhs.gov/hipaa/for-professionals/faq/570/does-hipaa-permit-health-care-providers-to-use-email-to-discuss-health-issues-with-patients/index.html)
- [FBI Internet Crime Complaint Center: 2025 IC3 Annual Report (PDF)](https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf)

## Free tools for this guide

- [Email Health Check](https://iblockspam.com/tools/email-health-check): Grade your domain's MX, SPF, DKIM, DMARC and transport security in one scan.
- [DMARC Checker](https://iblockspam.com/tools/dmarc-checker): Check your policy, reporting and the safe path from p=none to reject.
- [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer): Trace hops and authentication results — runs entirely in your browser.
- [MX Lookup](https://iblockspam.com/tools/mx-lookup): See where your mail is delivered, spot unfiltered backup MX and broken hosts.

---

Source: iBlockSpam, https://iblockspam.com/blog/email-security-for-medical-practices (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt