The Epic MyChart Phishing Campaign Exposes a Governance Gap Health Systems Can No Longer Ignore
More than a dozen U.S. health systems have issued warnings to patients about an active phishing campaign impersonating Epic MyChart. The emails look legitimate, the brand is trusted, and patients are clicking. Behind each of those clicks sits a potential HIPAA breach notification obligation, a medical identity theft victim, and a regulatory exposure that no cyber liability policy fully absorbs.
Background: Why This Campaign Works at Scale
Epic holds the patient portal relationship for more than 300 health systems and serves roughly 180 million patients through MyChart. That market concentration is a genuine clinical and operational achievement. It is also a threat geometry that most healthcare CISOs have not fully internalized.
Having led information services at NCQA and worked through EHR implementations across provider environments, I have watched how much institutional trust health systems extend to the big-name EHR brands by proxy. The patient receives an EHR-based email and assumes their health system sent it. The health system sees Epic in the communication chain and assumes security is managed upstream. Neither assumption is safe, and attackers have clearly figured that out.
A single phishing template, dressed in Epic's visual identity, functions as a cross-sector weapon. Attackers do not need to understand your specific EHR configuration or network architecture. They only need to know that your patients trust the MyChart name, and that you have probably not enforced DMARC across every domain authorized to send on your behalf. When one vendor brand intermediates patient communication for 300-plus health systems, compromising that brand's credibility compromises all of them simultaneously.
The Core Problem: Patient Portal Phishing Is a Different Threat Category
The standard response to phishing campaigns is to tell users to be more careful. I have watched that approach fail across federal, health plan, and provider settings for two decades. Expecting patients to reliably distinguish legitimate MyChart emails from spoofed ones is not a security control. It is an institutional abdication dressed up as user education.
Patient portal phishing is categorically different from employee phishing. When an employee credential is stolen, you face a defined containment problem: revoke access, investigate lateral movement, notify HR and legal. When a patient clicks a malicious MyChart link and submits credentials or PHI, you are looking at potential protected health information exposure, HIPAA breach notification obligations under 45 CFR §§ 164.400-414, downstream medical identity theft risk, and damage to the patient-provider relationship that took years to build.
HHS OCR has made the compliance standard clear through enforcement. The 2023 resolution agreement involving Doctors' Management Services, LLC, arising from a ransomware attack that began as a phishing compromise, specifically cited failures in risk analysis and access controls as the basis for sanction. OCR does not accept "we were phished" as an affirmative defense. The standard is whether your preventive architecture was reasonable given the known threat environment.
Most health systems have mature security programs protecting their internal network perimeter. Their patient-facing attack surface, particularly the email communication chain connecting them to patients through Epic and similar platforms, routinely receives far less scrutiny. That is the gap this campaign is exploiting.
Strategic Implications: Shared Infrastructure, Shared Risk
Consider the actual scope. A successful MyChart phishing campaign can expose PHI across multiple health systems simultaneously because attackers are running the same template against a shared vendor platform. This is not an isolated incident at one organization. It is coordinated exploitation of shared critical infrastructure, and your response architecture needs to reflect that reality.
Your cyber liability policy may cover breach notification costs. It will not cover the erosion of patient trust, the regulatory scrutiny that follows a multi-system breach, or the reputational consequences in competitive regional markets where patients have choices.
From a regulatory standpoint, HIPAA's Security Rule requires covered entities to implement technical safeguards protecting PHI transmitted over electronic communications networks. CISA's healthcare cybersecurity guidance has consistently identified email as the primary initial access vector for healthcare threat actors. The NIST Cybersecurity Framework 2.0 Govern function, which specifically addresses organizational context and supply chain risk management, applies here directly. Your patient portal email chain is third-party managed infrastructure carrying PHI by design. Treating it as someone else's responsibility is a compliance position that will not survive OCR scrutiny.
The organizations caught flat-footed this week are the ones that treated Epic as a trusted internal system and never formally audited the outbound patient communication chain. Strategic leaders treat that chain as a shared attack surface requiring explicit governance.
What Health System Leaders Should Do Now
Four actions belong on your CISO's desk this week.
First, audit every domain authorized to send email to patients on your behalf. This includes your primary domain, any Epic-specific sending domains, and any subdomains or third-party services in your email ecosystem. Confirm that DMARC is enforced at the reject policy level, not merely set to monitor. DKIM alignment must be verified for every sending path. This is foundational email authentication hygiene that the HHS 405(d) Health Industry Cybersecurity Practices framework calls out as a high-priority control for healthcare organizations, and it remains one of the most consistently unfinished items I see during security assessments.
Second, build a patient phishing response playbook that is separate from your employee incident response procedures. The notification thresholds, the HIPAA breach analysis workflow, the patient communication strategy, and OCR reporting triggers are all different from standard employee IR. Treating a patient PHI exposure as a variant of your existing playbook is a compliance risk you do not want to discover during an active incident.
Third, contact Epic directly and formally request their threat intelligence sharing protocols for active campaigns targeting the MyChart platform. If they do not have a structured mechanism for alerting health system customers to ongoing phishing campaigns using their brand, push for one. Epic's security team has cross-environment visibility that no individual health system can replicate.
Fourth, engage Health-ISAC if you are not already a participant. The 12-plus affected health systems likely had no coordinated alerting mechanism in place. Health-ISAC exists precisely to close that cross-organization gap, and the value of membership becomes obvious when a campaign like this one unfolds.
The Path Forward
Patient trust is the foundation of the care relationship. When phishing campaigns exploit the tools patients use to communicate with their health system, the damage is clinical as much as operational. The organizations that get this right do not wait for breach notifications to define their patient communication security posture. They audit the patient-facing attack surface, test their email authentication controls, and coordinate with peer organizations and vendors before the next campaign launches.
MTC Group LLC has helped multiple healthcare organizations build this kind of patient communication governance and compliance infrastructure. If your organization needs a structured assessment of your patient-facing attack surface, or a vendor risk program that formally covers Epic and similar platform partners, I welcome the conversation.
Sources & Further Reading
Health Systems Warn Patients About Epic MyChart Patient Portal Phishing Scam, HIPAA Journal
HHS OCR HIPAA Enforcement Actions and Resolution Agreements, U.S. Department of Health & Human Services, Office for Civil Rights
HHS OCR Breach Portal, U.S. Department of Health & Human Services, Office for Civil Rights
HIPAA Security Rule, HHS Office for Civil Rights
NIST Cybersecurity Framework 2.0, National Institute of Standards and Technology
Health Industry Cybersecurity Practices (HICP), 405(d) Program, U.S. Department of Health & Human Services
Healthcare Cybersecurity Resources, Cybersecurity and Infrastructure Security Agency
Health-ISAC, Health Information Sharing and Analysis Center
Comments