The MyChart Scam Out-Designed the Hospital

Epic is currently the most widely used and identifiable Electronic Health Records (EHR) software used by hospitals and healthcare systems in the United States.

But in August 2026, thousands of people began receiving emails and text messages that appeared to come from Epic’s MyChart patient portal. 

Epic wasn't hacked. Nothing was breached.

No firewall failed, no server was compromised, no vulnerability was exploited. 

But a phishing campaign designed to impersonate Epic’s MyChart patient portal fooled enough people that over forty health systems had to send out a warning.  

Most media outlets that have covered this story have called it a security problem, a cautionary tale of a patient clicking a sketchy web link.  That’s just part of it.  

The interesting part is that a scam with zero access to any real health system still managed to feel more convincing, more urgent, and more immediately rewarding than any invites from their actual provider.    

This shouldn’t be only characterized as a failure in security, it’s also design failure.   

Here's what actually happened. 

Scammers sent emails and texts made to look like they came from MyChart, containing false information.

Some messages led to a fake login page, a nearly identical copy of MyChart's real site, where patients typed in their username and password, handing scammers their credentials.

Break the scam down, and it's really just three basic moves, the same ones any good website UX/UI team leans on.

A Reward-  A rare incentive healthcare providers rarely offer patients.  Usual communication between provider and patient revolves around a bill or appointment reminder. 

This time, scammers offered what appeared to be a gift.  A free Medicare health kit, first-aid kit or senior wellness package.

The Urgency-  A countdown timer or "critical" lab result.  Both tactics put the pressure on the email recipient to act quickly.  A legitimate healthcare service would take a different approach.

An abnormal test result should feel quite urgent but usually just shows up as a simple email notification.  

The Familiarity-  And most effective method of deception.  The fake MyChart  login page was written in the same code and nearly identical to the original.  And it didn’t stop there.  After logging into this fake system where their login credentials were stolen, they were sent to a screen showing fabricated medical records and false test results.  The multi step process convinced patients of it’s legitimacy.  

 Patients weren't just vulnerable to a well-designed fake. They were primed for it.  

This is because legitimate healthcare technology has its own record of less than friendly patient web design throughout the years.

A 2026 benchmark study of major health insurance and portal websites found significant login friction on the majority of platforms tested, and patients openly said so:

"Its navigation is non-intuitive," one Kaiser Permanente user wrote. "I stumble through a lot of different pages before finally finding what I'm looking for," said another, describing Blue Cross Blue Shield.

The scammers seemed aware of this and took advantage of design flaws  

And in some ways, they designed an experience that much more user responsive and compelling than the real one. 

They could promise free products, manipulate urgency, and take users through a series of calls to take action and that lead to a compromise of personal information.  

MyChart Became Bigger Than the Hospital

The scammers chose MyChart due to it’s widespread use in hospitals nationwide.  They didn’t need to produce individual scams per hospital. 

MyChart is such a recognizable and trusted name that patients saw the email and didn’t think twice about clicking links within the message. 

Criminals are ultimately taking advantage of the popular name more than security vulnerabilities within the software system.  The trust was already built in.  

Scammers Didn't Need to Hack the Hospital

Hospitals spend millions protecting their networks, EHRs and patient data from cyberattacks.  

But this attack did not depend on hospital electronic system access. 

It’s  likely scammers didn’t even need specific patient email addresses.  

MyChart is so widely used that scammers could cast a wide net without even knowing which recipients were actually users of this software.  

Since MyChart is a highly trusted name, patients were more likely to trust a message that appeared to come from it.

Hospitals wouldn’t  have any control over what lands in a patient’s email box or text message. 

What Healthcare Organizations Can Actually Do About it

The standard response from healthcare phishing scams is to warn patients not to click suspicious links, check senders email address, to use the official MyChart app and never give out login credentials. 

That’s common sense practice, but involves putting most of the burden on the patient. 

Healthcare organizations often send out texts and emails to patients with appointment notifications, various links, and requests to login into patient portal areas. 

Many of these requests are quite time sensitive, and asking patients to be very cautious of scams at the same time can be confusing. 

They are being put into a position of trying to figure out what’s real and what isn’t 

Better UX/UI design can help patients recognize when they're actually interacting with the healthcare system. 

Banks solved a nearly identical problem years ago.

At setup, a patient could choose a private word or phrase, and every legitimate message from the portal would include it.

A scam email or text, with no access to that phrase, simply couldn't fake it, patients would have one instant, unmistakable way to tell real from fake.

Portals could also drop the clickable login link entirely. Instead of "click here to log in," a message could read: "Open the MyChart app and enter code: 482913." No link to click, no fake page landing page, the entire flow would require opening the app directly, making it unhackable.

Healthcare's Digital Trust Problem

More than 40 healthcare organizations issued warnings about this scam, but the number of victims and the financial damage remain unknown. 

This phishing campaign exposed something healthcare organizations shouldn't ignore: for a few days in August, a scam out-designed the hospital it was impersonating.

As more of the patient experience moves online, protecting patients isn't only about securing the technology behind the portal. It's also about making the legitimate experience easier to recognize and trust.