Vendor Used By Local Hospitals, Medical Offices Targeted By Scammers

Scammers are impersonating MyChart, the online health records system, in emails and text messages designed to persuade patients to click malicious links, surrender personal information or install malware, according to warnings issued recently.

Jefferson Health, Lower Bucks Hospital and Penn Medicine use MyChart, according to a review of their websites. Capital Health uses a different system.

Pennsylvania Attorney General Dave Sunday warned residents about a scam reported across the state in which messages falsely offer recipients a reward in the form of a “MyChart Medicare Kit.”

There is no such MyChart program or reward, according to the attorney general’s office.

The messages are intended to trick recipients into clicking links and providing passwords or other personal information. That information can allow hackers to gain access to patients’ MyChart accounts.

“Scammers are always looking for new ways to obtain as much of your personal information as possible,” Sunday said. “Stay on the lookout for this new scam tactic, and contact your medical office if you’re not sure how to access the MyChart website assigned to your providers.”

MyChart also warned that scammers may use its name or logo to make emails, text messages, phone calls and websites appear legitimate. Some attempts seek login credentials, while others promise free gifts in exchange for payment information.

“Always remember: stop and check if it doesn’t feel right,” MyChart said.

Patients should check the sender’s complete email address and the full website address before clicking a link or entering login or payment information, MyChart said. Small misspellings and extra words can be signs that a message is fraudulent.

Each health care organization has its own URL for MyChart.

Patients can use MyChart’s official search tool to find their health care organization’s website. MyChart.com, MyChart.org and Epic.com are official Epic websites.

Patients who are unsure whether a message or website is legitimate should contact their health care organization’s help desk before entering any information, MyChart said.

Epic and health care organizations will not ask patients for their MyChart passwords or verification codes by phone, text or email, according to MyChart. Patients also should not follow instructions to change contact information to a phone number or email address they do not control.

Health care organizations will not instruct patients to use keyboard shortcuts or run commands on a computer to “verify,” “fix” or “unlock” a MyChart account, the company said.

MyChart does not run giveaways, and patients should be skeptical of messages offering free gifts or prizes, including purported first-aid kits, in exchange for personal information.

Anyone who receives a suspicious message should not reply, open attachments or click links, including an “unsubscribe” link, officials said. The message can instead be reported as junk or phishing through the email provider.

Patients who clicked a link but did not enter information should close the page. Those who entered a password should change their MyChart password through their health care organization. Anyone who provided credit card information should contact their bank and have the card replaced.

MyChart also recommends that patients review the contact information listed in their account and check their account by opening the MyChart app or using a personal bookmark rather than following a link in a suspicious message.

Anyone who ran a program or followed instructions involving keyboard commands should disconnect the computer from the internet and have it checked before using it to access personal, financial or work information, MyChart said.

Consumers who believe they were victimized by the scam or have questions can file a complaint with the Pennsylvania Office of Attorney General’s Bureau of Consumer Protection by emailing scams@attorneygeneral.gov or by calling 1-800-441-2555.