Major U.S. Health Systems Warn Patients of MyChart Phishing Scam Campaign

Multiple U.S. healthcare systems using Epic Systems' MyChart patient portal have issued warnings about phishing emails impersonating MyChart communications. The scam offers false rewards like Medicare kits or senior health packages to steal patient login credentials, insurance information, and financial data. Patients are advised to delete suspicious emails immediately and never click embedded links.

Overview

Multiple U.S. healthcare systems have reported a phishing campaign impersonating MyChart patient portal communications. Healthcare providers using Epic Systems' electronic health records system, including Methodist Health System, Premier Health, Sentara Health, Metro Health, and Texas Health Resources, have issued warnings.

How the Scam Works

The phishing emails display the official MyChart logo to appear legitimate, but are not sent from actual healthcare provider addresses or Epic Systems. Common tactics include:

Claiming the recipient has won a "MyChart Medicare Kit" or similar free reward
Offering healthcare benefits, Medicare packages, or senior health packages
Sender email addresses differ from official healthcare domain names
May contain spelling and grammatical errors
Uses urgent language pressuring immediate action

What Scammers Are After

Cybercriminals aim to steal:

MyChart login credentials
Medicare insurance information
Bank account and credit card details
Other sensitive personal data

Warning Signs

Unsolicited emails offering free gifts or rewards
Sender's email address does not match your healthcare provider's official domain
Links embedded in the message that don't match official MyChart URLs
Spelling, grammar, or formatting errors
Requests to enter payment information or personal details
Pressure to act immediately

How to Protect Yourself

If you receive a suspicious email:

Delete the message immediately
Do not click any links, including "unsubscribe" links
Do not reply to the email
Never log into MyChart through a link in the email
Do not enter personal, financial, or insurance information

Verify sender authenticity:

Check the sender's complete email address and domain
Visit your healthcare provider's official website independently to verify any announcements
Contact your healthcare provider using verified contact information if you're unsure

If you've already taken action:

Immediately reset your MyChart password
Contact your healthcare provider's MyChart support team
Notify your bank and credit card companies if you entered financial information
Monitor your accounts for unauthorized activity

Important Context

This campaign exploits MyChart's reputation rather than indicating a security breach in the system itself. Patient email addresses may have come from previous data breaches unrelated to your current healthcare provider. Patients can continue using MyChart normally while remaining vigilant against phishing attempts.

Where to Report

If you receive phishing emails or become a victim:

Report to your healthcare provider's MyChart support team
Contact your financial institutions immediately if financial information was compromised
Report to the FBI's Internet Crime Complaint Center (IC3) at ic3.gov
File a complaint with the FTC at reportfraud.ftc.gov