If you’ve ever checked a lab result or messaged your doctor online, chances are you’re familiar with MyChart. It’s a popular patient portal from Epic that many hospitals and medical practices use to provide patients with online access to their health information.
Recently, a patient named Mary reached out with concerns after receiving updates from her primary care physician and specialists about shifting more communication to online platforms. “I’ve received multiple messages from my PCP and specialist doctors indicating they’re moving toward this, but it feels like a security risk!” she expressed. It’s a worry that seems pretty valid, especially with the reports of scams targeting MyChart users.
It’s crucial to clarify, however, that these warnings regarding scams include incidents where criminals impersonate MyChart through phishing attempts—not a breach of the MyChart system itself.
MEDICARE AND SOCIAL SECURITY SCAMS: WARNING SIGNS AND TIPS
Epic has indicated that there are scams that mimic the MyChart experience with the intent of stealing login details. Some of these scams can even introduce malware onto users’ computers. Here’s a rundown of how these scams operate and some tips on how to safeguard yourself from falling for them.
Why the MyChart phishing scam is getting attention now
This situation has drawn attention because several credible sources have issued warnings around the same time. For instance, Penn Medicine reported on August 26, 2026, about a nationwide scam utilizing emails and texts posing as MyChart communications. Just two days later, Pennsylvania Attorney General Dave Sunday raised concerns about another scam designed to impersonate MyChart and promote a fraudulent Medicare Kit.
Epic has documented two separate phishing campaigns that its security team identified over the summer. With all this information in play, it’s easy to understand why vigilance around unexpected MyChart messages is so important right now.
How the fake MyChart results scam works
One tactic begins with an email that looks entirely ordinary. Epic notes that such an email will brand itself as MyChart and state, “Your recent results are ready.” The link provided in the email directs users to a counterfeit sign-in page, complete with copied code designed to make it look legitimate.
This fraudulent webpage will prompt users for their email address and password, allowing scammers to capture this sensitive information. The scam escalates from there.
Fake medical results create panic
After logging in, the victim may be met with a fabricated medical record. There’s even a version where a pop-up claims that an “AI-powered review” has detected alarming patterns in blood work. This strategy is quite effective because warnings regarding health can provoke a much stronger reaction than generic phishing efforts.
Epic asserts that legitimate critical health results should come from your healthcare team rather than through a pop-up. The fraudulent site often demands that you complete a “human verification” process before revealing more details.
The verification step can install malware
This should raise immediate red flags. Epic explains that the phishing site may instruct Windows users to execute a command that would execute malicious software. This is a very risky scenario that must be taken seriously.
Another scam promises a free Medicare Health Kit
Another form of this scam approaches users with a different angle—promoting a spurious “2026 Medicare Health Kit.” Prudently, Penn Medicine has alerted users to communications offering a fake “MyChart Medicare Kit” or “Senior Health Package.” MyChart itself does not conduct any giveaways.
By clicking through, victims might be directed to unrelated advertising sites before hitting a fraudulent MyChart-branded survey with a ticking countdown, creating a false sense of urgency. The kit may appear to be free but will ultimately demand personal information and, notably, credit card details without ever shipping an actual item.
How to stay safe from fake MyChart messages
It’s wise to adopt a few simple habits to help protect yourself when navigating these pitfalls.
1) Open MyChart yourself
If you receive an email about new results, avoid clicking any links. Instead, access the MyChart app or website directly.
2) Check the full sender address
Diving into the sender address rather than just the name can reveal discrepancies—be cautious about any irregularities.
3) Never run computer commands for a patient portal
Remember, MyChart won’t ask you to execute keyboard shortcuts or commands as part of any account verification process.
4) Use two-step verification
Setting up two-step verification adds an extra layer of protection against unauthorized access.
5) Give MyChart its own password
Maintain unique passwords for each of your accounts, possibly utilizing a password manager to keep track.
6) Keep security protection running
Strong antivirus software can act as a safeguard against many of these scams, helping identify malicious links and downloads.
7) Verify scary medical claims another way
If an alarming claim surfaces in a message, don’t rush into clicking—verify through the official MyChart app instead.
8) Reduce the personal information scammers can find about you
The less information scammers can gather on you, the lesser chance they have to create convincing schemes. Consider using data removal services to manage your online presence.
9) Treat MyChart giveaways as a red flag
MyChart doesn’t do giveaways, so exercise caution if you encounter any messages claiming otherwise.
What to do if you already clicked a fake MyChart link
What you should do largely depends on your interaction with the deceptive page.
If you clicked but entered nothing
Mark the suspicious email as junk. Do not click on any links within it.
If you entered your MyChart password
Change your password immediately via the trusted app or website.
If you entered credit card information
Contact your bank to report the incident and consider getting a replacement card.
If you ran the Windows command or downloaded the program
Disconnect from the internet, have your computer checked for infections, and perform a thorough antivirus scan.
If your medical information looks wrong
Engage with your healthcare provider to address any discrepancies, as these issues can have broader implications.
Kurt’s key takeaways
This scam is particularly alarming because it leverages something we already do regularly—using patient portals for direct communication with healthcare providers. While I see the utility of MyChart, vigilance is vital. I would definitely navigate such communications with a heightened sense of caution. It’s all about taking a moment to verify rather than letting an urgent message dictate your actions. After all, a little time spent checking could save you from serious issues down the line.
Have you encountered suspicious MyChart communications? Share your experience with us.
