Millions of Americans now use the MyChart patient portal to track their test results, schedule appointments and message their care teams. But recently, hackers have been using the MyChart name to advertise a nonexistent Medicare kit to seniors by text or email to entice them to divulge personal and financial information.
Some 41 health systems nationwide have warned patients about the scam, which uses subject lines such as “Your MyChart Medicare Kit Awaits!” and refers to free senior wellness packages, Becker’s Health IT reported. These messages, which do not originate from either the health systems or MyChart itself, direct recipients to a fake website designed to collect users’ login and personal information. As such, organizations are urging patients to delete these emails without clicking any links.
With open enrollment for Medicare beginning Oct. 15, other scammers are also on the prowl, Money magazine reported. Older adults may also be targeted by phone calls seeking personal or financial information while claiming to need to verify a Medicare number, offering a new Medicare card or promising free medical equipment or genetic testing, the magazine said. The scams are another opportunity for journalists to warn and inform their audiences about the risks.
What to know
Gizmodo published a sample email as well as a few patient reports of what happened. It filed a Freedom of Information Act (FOIA) request with the Federal Trade Commission, which has received 166 complaints related to MyChart, although not all were related to the phishing scams.
Here’s the text: “Dear Member. Our records show that your account is eligible to receive the official MyChart Medicare Home Health Kit at no added cost to you. This comprehensive package is distributed as part of your annual wellness benefits to support daily home health monitoring. Because allocated inventory for your zip code [sic] is limited, unclaimed kits will be reassigned to the next member on the waiting list.” It also notes that unclaimed packages will expire in 48 hours.
Patients become accustomed to expecting legitimate correspondence through MyChart, such as lab results and billing statements, Giles Bruce wrote for Becker’s Health IT. With multiple Pennsylvania health systems seeing this, including Penn Medicine and Jefferson Health, the state’s attorney general, Dave Sunday, issued his own warning to Pennsylvanians in late August about the scam.
Trevor Berceau, director of research and development at Epic, the large health records company that developed MyChart, posted about the scams July 27, in which he attributed the rise in scam attempts to people trying to take advantage of MyChart’s popularity. The good news, Berceau said, is that these efforts do not present a security concern to the official MyChart applications, so people can continue to use them as normal.
Epic also maintains a website on how patients can protect themselves from scams and fraud. It offers advice such as guarding passwords and verification codes, and being skeptical of free offers. Regarding this specific scam, the company posted a reminder that MyChart does not hold giveaways, warns against clicking any links in the emails and says if a patient sees a countdown clock noting an offer will expire, it’s a red flag for a fake. Additionally, it reminds people not to pay any money or submit personal information.
Tips for your audience
When covering this or related scams, journalists should include information for consumers on warning signs to watch for and tips to try to prevent fraud. For example, people should not click on any messages allegedly from MyChart promising free health offers — even an “unsubscribe” button. Instead, they should open the health portal directly through the MyChart app or website to check for any account changes, the Money article recommended.
Other tips from the Gizmodo story: If a person enters credit card information, they should contact the bank to replace the card. And, if they downloaded or ran a program from a phishing site, or entered sensitive information, they should disconnect their computer from the internet and have it inspected by a tech expert before accessing any personal, financial or work accounts.
For other potential Medicare scams, people should hang up or ignore messages from scammers purporting to be from the Centers for Medicare and Medicaid Services, according to the Money article: “This is the biggest red flag…because the government won’t request your number out of the blue.” CMS may contact beneficiaries in certain circumstances, such as returning a call after a beneficiary contacts the agency or following a report of fraud.
New Medicare cards — likely linked to an earlier data breach, according to the Center for Medicare Advocacy — have been sent to about 1.3 million beneficiaries. They are provided free, so no one should give a payment. If the person has any questions, they should contact Medicare at 1-800-MEDICARE. Another good source is the AARP Fraud Watch Network Helpline, at 1-877-908-3990.
Story angles
As this story unfolds, there are still several angles journalists can cover:
- Ask executives at hospitals that use MyChart how they are educating/warning their patients.
- Interview physicians to see if any of their patients have reported receiving these emails.
- Interview patients who may have fallen victim to the scam to inquire about what happened, and what their advice is to others.
- Use this example as a jumping-off point to discuss good cybersecurity practices in general.
Resources
- There’s another new scam posing as MyChart – Consumer Affairs
- Medicare scams are surging ahead of open enrollment – Money
- 41 health systems warn of MyChart ‘Medicare Kit’ scam – Becker’s Health IT
- Why is MyChart becoming a cyber target? – Becker’s Health IT
- That free MyChart ‘Medicare Kit’ is a scam – Gizmodo
- Epic MyChart phishing scam hits health systems: What providers should do – MedCity News
- Older Americans and Medicare call scams – Federal Communications Commission
- Be aware of scams during Medicare open enrollment – AARP
- Got a new Medicare card in the mail? How to spot the real one from a scam –The Street
