Michael Bannach
The email arrives at 9:15 on a Monday, addressed to the front desk by name. It looks like it came from the practice’s dental supply rep, whose name and signature block are correct because they were copied from a real message. It says the sensor the office ordered last month has a revised invoice attached, and could someone confirm the account number so it ships. There is a PDF. Inside it is a button to view the invoice, and the button opens a login page that looks like Microsoft 365.
The person who opens it is not careless. She is managing a waiting room, a phone that will not stop, and a hygienist asking about a chart. She types her password because the page asked for it, and she has typed that password forty times this month. Nothing visibly happens, so she goes back to work.
For the next eleven days, someone else reads every email that arrives in that mailbox.
Why a practice is a better target than an office
Attackers do not pick dental and medical practices because the practices are careless. They pick them because the mailbox is unusually valuable and the people who use it are unusually busy.
A practice’s front-desk inbox carries insurance remittances, patient balance questions, records requests from other providers, vendor invoices for equipment and supplies, and the occasional payroll question. Every one of those is a ready-made pretext. A message telling the office to “re-verify your electronic remittance enrollment before the next payment run” does not look strange, because payers and clearinghouses send messages almost exactly like it.
And the clinical data behind that mailbox is covered by HIPAA, which means a compromised account is not just an IT problem. Depending on what the attacker could read, it can be a reportable breach with patient notification letters attached.
The spam filter is not the control you think it is
When we ask practices what protects their email, the most common answer is “the spam filter that came with Microsoft.” That filter is good at what it was built for: bulk junk, obvious malware, known-bad senders. It is poor at the message in the opening of this article, because that message is not bulk, carries no malware, and comes from a domain that was registered last week and has never sent spam.
Three things actually stop that message, and they are layered, not alternatives.
Multi-factor authentication on every email and clinical login. When the front desk typed her password into the fake page, MFA is what should have made that password, on its own, worthless to the person who collected it. Not MFA for the dentist and the office manager. MFA for every account that can read patient information, including the front-desk login that three people share. That shared login is the one most often skipped, usually because nobody wants to work out whose phone gets the code, and it is exactly the account an attacker hopes to find.
Advanced email protection in front of the mailbox. This is the layer that opens the PDF in a sandbox before it reaches anyone, rewrites links so they are checked at the moment of the click rather than the moment of delivery, flags a sender whose display name matches a known contact but whose address does not, and puts a visible banner on mail from outside the practice. In the opening scenario, the impersonation flag is what should have fired: the rep’s name was right and the address was one the office had never corresponded with.
Training that uses the practice’s own scenarios. HIPAA already requires security awareness training. The question is whether yours is a generic video nobody remembers or a session built around what actually lands in a dental inbox: the revised invoice, the remittance change, the records request with an attachment, the text from “the doctor” asking the office manager to buy gift cards for a patient appreciation event. Specific beats generic, and a two-minute reminder at a morning huddle between annual sessions beats silence.
What the eleven days look like
Here is what the attacker does with a front-desk mailbox, and the pattern barely changes from one practice to the next.
Days one through four, they read. They set a rule that quietly moves certain messages to a folder nobody looks at, so replies to the messages they are about to send never reach the staff. They learn which insurance carriers pay the practice, which vendors send invoices, and who approves them.
Days five through nine, they act. A request goes to the largest payer to change where the practice’s electronic remittances are deposited, and the confirmation that comes back is swept into the hidden folder. Patients with open balances get a friendly note from the front desk with a new link to pay online. The bookkeeper gets a real vendor invoice forwarded from the front-desk address with one line changed: the account number. All of it comes from the practice’s real address, so nothing about it looks wrong on the receiving end.
Days ten and eleven, someone notices. Usually the bookkeeper, when a payment that should have landed did not. By then the money is gone, the mailbox has to be treated as breached, and the practice is working out whether patient information was exposed and what that means for notification.
Three questions for whoever runs your IT
- Is multi-factor authentication turned on for every login in the practice, including the shared front-desk one, and can you show me the list?
- What checks a link or attachment after it arrives, and what happens when a sender’s name matches a contact but the address does not?
- When was the last phishing test, what was the click rate, and what did the people who clicked get told?
A good provider answers all three with specifics in a few minutes. If the answers are “we would have to check,” that is the answer.
How we handle it for Stealth RX practices
Every Stealth RX practice gets the same baseline regardless of package: multi-factor authentication on email and clinical logins, managed endpoint protection, 24/7 monitoring that notices a new inbox rule or a login from somewhere the practice has never been, encrypted email where it is needed, and annual HIPAA and security awareness training for the whole staff with completion records you can hand to an auditor. The spam filter that comes with the mail platform is not the advanced email protection described above, and a practice should not be running without that layer, whoever puts it there. The point is not to make your front desk paranoid. It is to make the mistake she will eventually make, because everyone does, cost the practice nothing.
If you want a straight read on where your practice stands, the three-minute IT and security scorecard sends you a written roadmap. The conversation afterward is free, and it is usually short.
