Phishing in dental and medical offices

The scams front desks see most

1. 1. Fake patient emails with attachments “Here are my X-rays”, “my referral form”, “insurance card attached”. The attachment is a document that asks you to “enable editing” or a link to a shared file that asks you to sign in. Real patients rarely send a file that needs your email password to open.
2. 2. Fake insurance or payment portal links “A claim was denied, log in to the provider portal to fix it” or “a patient payment failed”. The link goes to a copy of the portal on a look-alike address and collects the office’s sign-in.
3. 3. Vendor and invoice fraud An email that looks like your dental supplier, lab or billing service says their bank details changed, or sends an overdue invoice with a new account number. Sometimes it comes from the vendor’s real mailbox after it was broken into.
4. 4. Fake IT support A call, email or pop-up says the computer is infected or the email account will be closed, and asks you to install AnyDesk, TeamViewer or a “security update”, or to read out a code.
5. 5. Fake HIPAA-audit or “records request” emails “Notice of HIPAA audit: respond within 48 hours”, or a lawyer, insurer or another office urgently asking for patient records. Fear of a penalty makes people click before they check.

What it can look like

Red flags

• Pressure and deadlines: “within 48 hours”, “final notice”, “penalties”, “your account will be closed”.
• A sign-in page right after you click a link or open an attachment, especially one asking for your email password.
• New bank details for a vendor, or a payment request that skips your usual steps.
• A sender name you know with an address you don’t, or an address with an extra word or a swapped letter.
• Requests to install remote-access software, turn off security, or read out a code.
• Anyone asking for patient records, a patient list or insurance details by email, in a hurry.

What to do

1. Don’t open attachments you weren’t expecting. Ask the patient to bring the file, use your patient portal, or call them on the number in their chart.
2. Open portals yourself. Use a bookmark for each insurance, payment and lab portal, and never sign in from a link in an email.
3. Confirm any bank-detail change by phone, using the number you already have for that vendor, not the one in the email. Two people sign off on new payment details.
4. Real IT support doesn’t call out of the blue. Only let your own IT person or company connect to a computer, and never read out a code.
5. Send any audit, legal or records request to the practice manager or compliance officer before anyone replies or clicks.
6. Make it easy to ask. “I wasn’t sure, so I checked” should get a thank-you, every time.

If someone already clicked, paid or shared a password

Don’t panic, and don’t blame the person who spotted it. Act quickly, one step at a time.

• Tell the practice manager right away. Minutes matter, and nobody should be blamed for reporting it.
• If a password was typed into a fake page, change it now from a computer you trust, starting with email, and sign out other sessions.
• If money was sent, call your bank on the number on your card or statement and ask them to stop or recall the payment.
• If someone installed remote-access software, unplug the network cable or turn off Wi-Fi and call your IT person.
• If patient information may have been exposed, talk to your compliance officer about next steps, including whether you need to notify anyone.
• Report it at ReportFraud.ftc.gov or ic3.gov, especially if money was lost.

How Scam Guard Workplace helps

Gmork Scam Guard Workplace is a browser extension for Chrome and Edge on the office computers. It gives a clear warning on fake sign-in pages, look-alike and disguised sender addresses, links whose text shows one site but go to another, pressured payment requests to new bank details, gift card requests, and requests to install remote-access tools. Workplace display keeps the cards readable on a busy screen, and a PIN and strict mode stop warnings from being switched off by mistake. For healthcare offices, the plan owner can turn on HIPAA-safe mode for every browser on the license: the AI check is off, only the built-in local rules run, and the only things that leave the browser are bare domain names for sender and link checks and the daily warning counts. Gmork’s server also refuses AI requests from those browsers. HIPAA-safe mode is not a HIPAA certification and doesn’t make your office compliant on its own. A Business Associate Agreement (BAA) is required before any AI use with patient health information (PHI), so check with your compliance officer. Scam Guard can miss scams, so the habits above still matter most.

How HIPAA-safe mode works, what it does and doesn’t do and Workplace plans.

Questions people ask

Does Gmork have a HIPAA certification?

No. There is no official HIPAA certification for software, and Gmork doesn’t claim one. HIPAA-safe mode limits what leaves the browser (AI off, local rules only, bare domain names and counts). Whether your office meets HIPAA depends on your own policies, agreements and safeguards. Ask your compliance officer.

Can we use the AI check with patient email?

Not without a Business Associate Agreement (BAA) in place first. Until then, keep HIPAA-safe mode on so no email or page text is sent to Gmork or any AI service.

Does it read our patient records?

No. Scam Guard looks at the email, chat or page that’s open in the browser, on the computer itself. It doesn’t connect to your practice management or records software. You can also add sites it should never look at, like your records system.

We’re a small office with no IT person. Is this still worth it?

Yes. The habits above cost nothing, and they stop most of these scams. Scam Guard adds a second pair of eyes on the screen when the desk is busy.