Most attacks against small healthcare practices start with a message someone trusted. This page explains how phishing, business email compromise, and account takeover actually work in a medical office, and what to verify.
Your practice email account is not just a messaging tool. It is a key to your scheduling system, your patient portal, your billing platform, your bank, and often your electronic health record login. It also holds years of attachments, referral letters, imaging results, insurance correspondence, and patient questions. That makes it one of the most valuable targets in a small healthcare practice, and one of the most commonly compromised.
The pattern is consistent. Someone on your team receives a message that looks routine: a shared file from a referring provider, a password expiration notice, an invoice from a vendor, a request from the practice owner. They enter their credentials on a convincing but fake login page, or approve a multi-factor prompt they did not expect. The attacker now has access to a mailbox and, in many cases, everything connected to it. No malware required.
This matters more in healthcare than in most industries because mailboxes frequently contain electronic protected health information. HHS Office for Civil Rights data consistently shows hacking and IT incidents, including email compromise, as the dominant cause of large reported healthcare breaches. When a mailbox containing ePHI is accessed without authorization, you are not only dealing with a security problem. You may be dealing with a reportable breach under the HIPAA Breach Notification Rule, with notification obligations to patients, to HHS, and potentially to media outlets when more than 500 individuals are affected.
Having a spam filter is not the same thing as having email security. Having multi-factor authentication turned on is not the same thing as knowing it is configured to resist the techniques attackers actually use. Sentree Systems works with dental, eye care, surgical, and other independent practices to look at email the way an attacker would, then close the gaps that matter most.
Start with a straightforward question: if a front desk mailbox were accessed by someone outside your practice tomorrow, how would you know, how fast would you know, and who would decide whether patients need to be notified?
A practical walkthrough of phishing, impersonation, payment fraud, and mailbox takeover in small practices, plus the controls and checks that make a measurable difference.
Business email compromise in healthcare rarely looks dramatic. It looks like business. An attacker who controls a mailbox reads quietly for days or weeks, learning how your practice talks about payments, referrals, and payroll. Then they send a message from a real internal address asking a real staff member to update banking details for a vendor, redirect an insurance payment, or share a patient roster. Because the message comes from a legitimate account, it passes authentication checks and looks normal to everyone who reads it.
There are a few variations worth recognizing. Vendor impersonation targets your accounts payable process, often using a lookalike domain that swaps one character. Owner or provider impersonation pressures a practice manager to move money or send a file quickly. Payroll diversion asks HR or the office manager to change direct deposit information. Patient-facing impersonation is the one practices tend to overlook: an attacker using a compromised practice mailbox to email patients directly carries your credibility with them, which is a trust problem as well as a security problem.
Account takeover prevention comes down to a handful of controls that are usually available in Microsoft 365 or Google Workspace and frequently left unconfigured. Legacy authentication protocols that bypass multi-factor authentication should be disabled. Multi-factor methods should be phishing-resistant where possible, which means number matching or hardware keys rather than SMS codes. Mailbox auditing and sign-in logging need to be turned on and actually reviewed, because that log is what tells you the scope of an incident later. Mail forwarding rules to external addresses should be blocked or alerted on, since attackers create them to keep reading your mail after a password reset. SPF, DKIM, and DMARC records should be published and enforced so your domain is harder to spoof. Conditional access rules can limit sign-ins from unexpected locations or unmanaged devices.
Technology only carries part of the load. The other part is your people and your process. Staff who handle payments, referrals, and records need a verification habit for anything involving money or patient data: confirm by phone using a known number, never by replying to the message. That habit is far more reliable than expecting people to spot a well-crafted fake, which is why reducing phishing risk among healthcare employees is treated as an ongoing practice, not an annual video. Pair that with regular vulnerability management so exposed services and unpatched systems do not quietly widen the gap.
Finally, connect email security to your obligations and your recovery plan. Your HIPAA security risk analysis should document how ePHI moves through email and what safeguards apply, and your incident response plan for the practice should spell out who investigates a suspicious sign-in, who preserves logs, and who makes the breach determination. Understanding where HIPAA cybersecurity requirements end and real-world protection begins keeps you from mistaking paperwork for defense.