EHR Scam

An electronic health record (EHR) system is a digital, evolving record of a patient’s health information. It can include diagnoses, medications, allergies, test results, clinical notes, and demographic details, and can make relevant information available to authorized care teams across different settings. EHRs also support clinical and administrative tasks, including registration and scheduling. Patient portals may let people view EHR information, communicate with providers, and manage appointments.

What is an EHR account scam?

An EHR scam is an attempt to deceive a patient, staff member, or healthcare organization into revealing information or granting access to an account or system connected with an EHR. Scams may target portal login information or personal and insurance data to enable medical identity theft, so that an unauthorized person can use that information to obtain care or submit false claims. This kind of fraud typically confuses or combines patient data in ways that can mix or duplicate records, creating patient misidentification that can affect care, billing, and insurance benefits.

This is a list of online scams that may involve EHRs or healthcare accounts:

• EHR phishing: A message impersonates a provider or portal and directs someone to a fraudulent sign-in page or asks them to disclose a password or verification code.
• Account takeover: A scammer uses stolen or reused credentials to enter a patient portal, view information, or make unauthorized changes.
• Medical identity theft: Someone uses stolen personal or insurance details to seek care, obtain prescriptions, or submit claims in another person’s name.
• Impersonation and enrollment fraud: Someone poses as a patient to create or access an account, or to change contact details associated with it.
• Fake support or account recovery: A caller or message claims to be a service desk or provider representative and requests sensitive information to “fix” an account.

Healthcare account scams can create EHR login issues. Because of scams, a provider may lock an account, require stronger identity checks, or delay account recovery. A patient who cannot verify their identity online may struggle to enroll in a portal, to confirm or schedule appointments, or to update an email address, phone number, or other login details. Some organizations may require an in-person visit to confirm identity before changing contact information. While that check may be needed to prevent an unauthorized person from taking control of an account, requiring an in-office visit for identity verification can burden patients and increase service desk work. Strong security for EHR patient login portals should pair reliable identity verification with convenient recovery processes that patients can use without experiencing unnecessary delays.

Imprivata offers healthcare identity and access solutions that can help organizations strengthen verification and manage secure access across clinical workflows. Imprivata Patient Access supports patient identification and portal account enrollment and recovery, while its healthcare access management solutions support staff authentication for accessing EHR systems. These and other capabilities can help organizations protect patient information while making identity checks and account access more manageable for patients, care teams, and service desks.