If you clicked a suspicious link at work, stop interacting with it and report the event immediately through your practice's established incident channel. Tell IT whether you entered a password, approved a sign-in prompt, downloaded a file, or opened it. Quick, accurate reporting helps the response team choose the right containment steps.
An unexpected "secure document," overdue invoice, or account warning can arrive during the busiest part of the day. This is not the time to blame the employee or wait until the end of a shift. The practice needs useful information and a coordinated response.
First, identify what happened
You clicked, but did not enter information
Close the suspicious page and contact support. Do not revisit it to investigate. Clicking does not automatically prove that your account was compromised, but it also does not establish that nothing happened. Tell IT whether a download started, a permission request appeared, or the browser showed an unusual warning.
You entered a password
Tell IT immediately and identify the affected account. A password change may be necessary, but changing the password alone may not end existing sessions or remove other access an attacker obtained. Your administrator should coordinate account containment from a trusted environment.
If you reused that password for another account, report the reuse without sending the password itself. Follow IT's instructions for changing other affected credentials through known official sign-in pages.
You approved a sign-in or granted an application access
An unexpected multifactor authentication prompt can be significant, even if you did not type a password into a suspicious page. Report the time, affected account, and what you approved. Application consent and authentication approvals can require different remediation steps.
You opened a downloaded file or see signs of malware
If you see a ransom message, unexpected file changes, or other signs of active compromise, use your documented emergency procedure and contact IT immediately. CISA recommends isolating impacted systems during ransomware response.
If your procedure directs you to disconnect the affected workstation, do so without changing shared infrastructure. Otherwise, obtain urgent instructions. Do not run cleanup utilities, wipe the computer, or power it off unless the response team directs you; those actions can destroy useful evidence.
Give the response team a useful report
Include the time, workstation name, affected account, sender address, message subject, and actions you took. Explain whether you supplied credentials or approved a prompt. Use the approved reporting tool or contact channel, not an ordinary forward to the whole team.
Do not paste patient data, passwords, authentication codes, or the suspicious link into a group chat. Preserve the original message according to your response procedure so administrators can examine it safely.
If your email account may be compromised, use a known phone number or another approved channel to contact IT. Do not rely on a new support number displayed in the suspicious message.
What IT should investigate
Depending on the incident, the response team may review sign-in activity, revoke sessions, reset credentials, inspect mailbox rules and forwarding, remove unauthorized application access, and check the workstation for malicious activity.
They should also investigate whether other staff received the same message and whether the attacker attempted payment redirection, data access, or further phishing from the affected account.
The scope matters. An account can be misused without ransomware, and an infected workstation can present risks beyond email. Recovery should follow evidence rather than the assumption that one password reset solved everything.
Does this automatically mean a HIPAA breach?
No. A suspicious click is an event that needs assessment, not an automatic conclusion about a reportable breach. Conversely, a quick password reset does not prove that protected information was unaffected.
Your designated privacy or security lead, IT response team, legal counsel, and insurer where applicable should coordinate the investigation and any notification decisions. Contractual and legal obligations can differ; follow your incident plan rather than waiting for a general deadline described online.
Prevent the next incident without blaming staff
Make reporting easy and reward prompt disclosure. Reinforce known sign-in routes, verified payment-change procedures, multifactor authentication, and appropriate email protection. Staff should know how to refuse unexpected prompts and verify unusual requests using established contact details.
A short, realistic response exercise helps the team practice who to call and what to report. Its purpose is readiness, not catching someone making a mistake.
Frequently asked questions
Should I delete the message immediately?
Use your reporting procedure first. IT may need the original message for analysis. Do not keep interacting with it while waiting.
Can multifactor authentication stop every phishing attack?
No. It is an important safeguard, but attackers may target approvals, sessions, or application permissions. Authentication method and configuration matter.
Can we keep using the affected computer?
Ask the response team. They should decide based on the evidence and containment needs, while clinical leadership manages any resulting workflow disruption.
Prepare before an incident happens
Consolidated IT Solutions helps practices strengthen email security and incident readiness. Request an Assessment. For an active incident, use your existing emergency support channel rather than waiting for an assessment response.
Sources and further reading
CISA: Recognize and Report Phishing. https://www.cisa.gov/secure-our-world/recognize-and-report-phishing
CISA and partner agencies: #StopRansomware Guide. https://www.cisa.gov/stopransomware/ransomware-guide