If an employee clicked a phishing link, the safest first step is to report it immediately. A link click does not always mean an account or device was compromised, but delaying a report can make it harder for the practice to understand what happened and limit potential harm.
This first-hour guide is for clinic staff and practice leaders. Follow your organization’s incident-response plan and let the designated IT or security responder direct technical steps. The CISA phishing guidance can also help practices think through reporting and response.
First, report it without delay
The employee should contact the practice’s IT support or designated incident lead using a trusted phone number or reporting method, not by replying to the suspicious message. If the practice has a privacy officer or compliance lead, notify that person through the established process as well. Don’t wait to confirm that information was stolen or to finish collecting every detail.
Staff should be encouraged to report a click without fear of blame. A quick, accurate report gives responders a chance to check the account and device, assess possible access to patient information, and help maintain care operations. For a refresher on staff awareness and escalation practices, see Zevonix’s guide to HIPAA training for healthcare IT staff.
What to include in the report
Share what is known, and clearly identify anything that is uncertain. Useful details include:
- When the message arrived and when the link was clicked.
- The employee’s work device and account, such as their work email or workstation.
- The sender’s name and email address, the subject line, and whether the message included an attachment.
- The link or attachment involved. Do not open it again to copy or inspect it; let IT advise how to provide the message safely.
- What happened after the click: whether a webpage opened, credentials were entered, an MFA prompt was approved, a file was downloaded or opened, or anything else was submitted.
- Any unusual signs, such as unexpected sign-in prompts, pop-ups, unfamiliar account activity, or a device behaving differently.
- Whether the employee was working with patient or business information at the time, and whether anything may have been viewed, changed, sent, or downloaded.
A simple report can be: “I clicked a link in a message that appeared to come from ____. It happened around ____. I used my ____ account on my ____ device. The page ____. I did or did not enter a password, approve an MFA prompt, or download a file. I noticed ____.” Staff can report incomplete information and add details later.
During the first hour: a practical response
Right away: stop interacting and alert the right people
Stop using the link and do not enter more information, approve another prompt, or download anything else. Tell IT or the incident lead what happened, including whether the employee entered a password or approved MFA. If the message is still open, avoid forwarding it or deleting it; ask the responder how to preserve and share it.
If the employee entered a password, say which account was involved. If they approved an unexpected MFA request, report that too. IT can decide how to secure the account, check for suspicious sign-ins, and handle active sessions. Do not reuse the affected device to change passwords unless IT says it is safe; use a trusted device and the practice’s approved process.
Next: let IT guide device and account containment
Do not automatically shut down the computer or unplug it from the network. That may affect the responder’s ability to assess what happened. Stop interacting with the device and contact IT for instructions. If the device is showing unusual activity, or a file was downloaded or opened, say so immediately. Follow the practice’s incident plan if IT is not immediately reachable, and avoid taking technical steps outside your training or assigned role.
IT may need to secure an account, examine the device, or limit connections. Staff should not delete files, clear browser history, run unfamiliar cleanup tools, or try to investigate the link themselves. Those actions could remove useful information or make the situation harder to assess.
As the response continues: preserve evidence and support care
Keep the original message and any related details available. Do not click the link again, reply to the sender, or send the message to colleagues for review. Preserve notes about what the employee saw and did, and follow IT’s directions for sharing screenshots or files. A responder may ask the employee to describe the page or report visible symptoms without reopening it.
The incident lead should also consider whether clinical systems or workflows need attention. If access to an EHR or another essential system is affected, follow the practice’s established downtime process and prioritize safe patient care. Zevonix’s EHR downtime checklist can help practices plan for keeping workflows moving when systems are unavailable.
Clicking is not the same as confirming a breach
A click by itself does not establish that an attacker accessed an account, a device, or patient information. The practice needs to assess what happened after the click, what systems or information may have been involved, and what evidence is available. Staff should report concerns promptly rather than decide on their own whether the event qualifies as a breach.
The practice’s authorized privacy or compliance lead should coordinate that assessment with IT and other appropriate advisors. Florida law includes breach-notification requirements, but whether they apply depends on the facts and circumstances; the practice should have its authorized leadership assess the situation with qualified counsel and consult the official Florida statute.
Frequently asked questions
Who should the employee notify, and how quickly?
Notify the practice’s IT support or designated incident lead immediately using a trusted contact method. Follow the practice’s process for notifying its privacy officer or compliance lead. Don’t wait until the employee knows whether information was exposed.
What if the employee entered a password or approved an MFA prompt?
Report exactly what happened, including the account involved and whether the prompt was unexpected. IT should direct the account-security steps. Do not approve further prompts or change credentials from the potentially affected device unless instructed.
Should the employee disconnect or shut down the computer?
Not automatically. Stop interacting with it and ask IT what to do. Follow the practice’s incident plan if a responder is not immediately available, especially if the device is behaving unusually or a file was opened.
Does clicking a phishing link automatically mean there was a HIPAA breach?
No conclusion can be drawn from the click alone. The practice must investigate what occurred and whether protected information or systems were involved. The designated privacy or compliance lead should assess reporting obligations with appropriate advisors.
When should the practice contact its IT provider?
As soon as the employee reports the incident. Prompt contact gives IT a chance to assess the account and device, guide containment, and help the practice keep necessary clinical workflows operating.
Make fast reporting part of the response plan
A calm, prompt report helps the practice understand the incident and decide what to do next. Make sure staff know whom to contact and what details to share before a suspicious message arrives. Zevonix provides IT support for medical practices across Florida, including remote and onsite support and 24/7 monitoring. If your practice needs help responding, contact Zevonix at (904) 658-0777.