Urgent Cybersecurity Alert: Hackers Targeting Dental Practitioners With Phishing Scams, FBI Warns
Because they possess a treasure trove of personal, financial, and health information about hundreds or thousands of patients, physicians, dentists, and other healthcare practices and facilities are the frequent targets of hackers and cyberattacks. That threat has not diminished, and in a May 6, 2024 notice to the American Dental Association (ADA) and the American Association of Oral and Maxillofacial Surgeons (AAOMS), the Federal Bureau of Investigation (FBI) warned of a credible, active cybersecurity threat to the practices of oral and maxillofacial surgeons. While this current threat is focused on oral and maxillofacial surgeons, the FBI has expressed concern that the practices of general dentists and other specialists could also eventually be targeted.
According to the ADA, the FBI suspects that the group behind the cyberattacks may be shifting tactics to oral and maxillofacial surgery practices after targeting plastic surgeons last year. Accordingly, all dental practices and practitioners need to be on high alert against such attacks, which focus on “social engineering scams” — such as phishing (email), SMSishing (through text or instant messaging apps), and vishing (using phone calls and voicemail) — to gain access to sensitive personal data such as electronic protected health information.
In particular, the FBI warns of “spear phishing,” which refers to a phishing email that appears to be from a trusted contact. Through these scams, the FBI says, “threat actors try to convince people to reveal sensitive information, or to click on a link, open an attachment or visit a website that causes malware to be deployed. This malware can lead to ransomware, which blocks system and/or file access until money is paid.”
The FBI provided an example of such a scam:
A threat actor poses as a new patient or says they want to become a patient at the practice to obtain new patient forms online. Once the forms are received, the threat actor will then contact the practice to report they are having trouble submitting them online and ask if they can scan the forms and email them instead. The threat actor then emails the “forms” as an attachment. When the attachment is opened, malware is deployed through a phishing scheme.
The FBI requests dental practices that experience any fraudulent or suspicious activities to report them to the FBI Internet Crime Complaint Center at ic3.gov.
Precautions Dental Practices Can Take To Protect Against Phishing and Other Cyberattacks
The Cybersecurity & Infrastructure Security Agency (CISA) recommends four vital ways to protect your practice from cyberthreats:
Teach your team to recognize and avoid phishing
Require multi-factor authentication
Additionally, practices should have policies and protocols in place to immediately respond to and remediate any data breaches that result from a phishing scam or other cyberattack.
The following resources are also available to support dental professionals:
A CISA.gov toolkit aids healthcare practices in building cybersecurity foundations and implementing more advanced, complex tools to stay secure and ahead of current threats.
The U.S. Department of Health and Human Services’ Knowledge on Demand resource offers five free cybersecurity trainings that align with the top five threats named in HHS’ Health Industry Cybersecurity Practices. HHS also provides information on how the HIPAA security rule can help defend against cyberattacks.
The Office of the National Coordinator for Health Information Technology’s Security Risk Assessment Tool, a resource designed to help medium and small providers conduct a security risk assessment as required by the Health Insurance Portability and Accountability Act.
The U.S. Department of Health and Human Services Office of Information Security and Health Sector Cybersecurity Coordination Center’s “Artificial Intelligence, Cybersecurity and the Health Sector” guide shares how healthcare entities help protect against AI-enhanced cyberthreats.
Additional resources can be found at ADA.org/riskmanagement
Call Grogan, Hesse & Uditsky Today
At Grogan, Hesse & Uditsky, P.C., we focus a substantial part of our practice on providing exceptional legal services for dentists and dental practices, as well as orthodontists, periodontists, endodontists, pediatric dentists, and oral surgeons. We bring unique insights and deep commitment to protecting the interests of dental professionals and their practices and welcome the opportunity to work with you.
If you have questions or concerns about your practice’s compliance with HIPAA, please call us at (630) 833-5533 or contact us online to arrange for your free initial consultation.
Jordan Uditsky, an accomplished businessman and seasoned attorney, combines his experience as a legal counselor and successful entrepreneur to advise dentists and other business owners in the Chicago area. Jordan grew up in a dental family, with his father, grandfather, and sister each owning their own dental practices, and this blend of legal, business, and personal experience provides Jordan with unique insight into his clients’ needs, concerns, and goals.
Speak to an Attorney
