By Eric Andrew Kristof, RN, CAHIMS | Healthcare IT Professional | HIMSS Arkansas Chapter Member
About This Series: The HIMSS Word of the Day is a running blog series drawing from the HIMSS Dictionary of Health Information and Technology Terms, Acronyms, and Organizations, 6th Edition (2025) — the authoritative reference for healthcare IT professionals and the primary study resource for CAHIMS and CPHIMS certification. Each post paraphrases the term in plain language, grounds it in real-world healthcare IT context, and adds a bedside nursing perspective you won’t find in a textbook.
📖 The Term: Phishing
Source: HIMSS Dictionary of Health Information and Technology Terms, Acronyms, and Organizations, 6th Edition (2025)
🔍 Plain-Language Definition
Phishing is a scam in which an attacker pretends to be someone trustworthy in order to trick a person into giving up sensitive information, such as a username and password, or into taking a harmful action, such as opening a malicious attachment.
The HIMSS Dictionary keeps its definition short: phishing is a deceptive, technology-based method of fooling people into revealing sensitive personal information. The name plays on “fishing”: the attacker casts a lure and waits for someone to bite.
Phishing is a form of social engineering, which means it attacks people rather than software flaws. It works because it exploits ordinary human reactions, such as urgency, curiosity, fear, and the wish to be helpful.
Phishing has many variants:
| Type | How It Works | Healthcare Example |
|---|---|---|
| Email Phishing | Mass emails with a fake link or attachment | A “password expiring” notice that leads to a fake hospital login page |
| Spear Phishing | A targeted message using details about the recipient | An email to a unit manager that appears to come from the CNO |
| Whaling | Spear phishing aimed at executives | A request to the CFO to approve an urgent vendor payment |
| Smishing | Phishing by text message | A text claiming a payroll deposit problem with a link to “verify” |
| Vishing | Phishing by phone call | A caller posing as IT support asking for a login to “fix” an account |
| MFA Fatigue | Repeated login approval prompts until the user accepts one | A flood of push notifications at 3 a.m. after a password has been stolen |
⚠️ Exam Alert: Phishing is the delivery method that tricks a person. Malware is the malicious software that may be delivered. Ransomware is a type of malware that encrypts data and demands payment, and phishing is one of its most common entry points. Business email compromise (BEC) uses a hijacked or spoofed email account to redirect payments or data. Exam questions often ask which control best addresses a social engineering threat; the answer usually combines training with technical controls such as multifactor authentication.
🌐 Why It Matters: Real-World Healthcare IT Context
Healthcare is an attractive target. Hospitals hold valuable data, operate around the clock, depend on email and remote access, and employ large workforces with varied levels of technical training. A single set of stolen credentials can give an attacker access to email, the EHR, or remote systems.
Research shows how often lures succeed. A 2019 study in JAMA Network Open examined nearly 3 million simulated phishing emails sent by six U.S. health care institutions and found that 14.2% were clicked, almost 1 in 7. Repeated simulation campaigns were associated with lower odds of clicking. A separate 2019 study in JAMIA, from the same lead author at a single health system, found that click rates dropped over repeated campaigns, but a mandatory training program for the employees who clicked most often did not substantially reduce their click rates compared with others. Together, those results suggest that awareness helps, but no training program alone can be counted on to stop phishing.
HHS’s 405(d) program addresses phishing in its Health Industry Cybersecurity Practices (HICP) publication, which identifies the most relevant threats to the healthcare and public health sector and pairs them with practical safeguards. Phishing also connects to HIPAA: a successful attack that exposes protected health information can become a reportable breach.
Why phishing succeeds:
- Messages that create urgency, such as payroll, password, or patient-related alarms
- Spoofed or look-alike sender addresses and logos
- Busy clinicians reading email on mobile devices between tasks
- Reused or weak passwords, and accounts without multifactor authentication
- Help desk processes that reset credentials without strong identity checks
- Shared workstations where a compromised session is used by others
Layered defenses that help:
- Phishing-resistant multifactor authentication, especially for email and remote access
- Email authentication (SPF, DKIM, and DMARC) and filtering that blocks spoofed senders
- External sender banners and link scanning
- A one-click “report phishing” button with fast feedback from the security team
- Regular simulation and short, relevant training
- Least-privilege access so a single account cannot reach everything
🏥 The Nurse’s Perspective: Clinical, Bedside, & Workflow
Nurses are frequent phishing targets because they have broad system access, work under time pressure, and read messages in short gaps between patient care tasks.
At the Bedside
Phishing attempts often arrive when attention is lowest, such as in the middle of a night shift or during a busy medication pass. A message warning that a badge, a paycheck, or a license renewal needs immediate action can look urgent enough to click. The safest response is to pause, avoid the link, and check through a known channel, such as calling the help desk number posted on the unit.
Clinical-sounding lures are especially effective. A fake email about a patient complaint, a shared lab report, or a schedule change can feel like part of normal work.
In Clinical Workflow
Phishing does not stay in email. Nurses may receive text messages, phone calls, or even in-person visitors claiming to be from IT or a vendor. Legitimate support teams have ways to confirm their identity, and nurses can ask for a ticket number or call back through the official help desk before sharing anything.
Reporting suspected phishing quickly protects the whole organization. When one nurse reports a message, the security team can often remove the same message from hundreds of other inboxes before anyone else clicks.
In EHR Implementation (Go-Live Perspective)
Go-Live periods are a favorite time for attackers. New logins, new password rules, and frequent emails from the project team create the perfect cover for messages that say “activate your new account” or “confirm your credentials before Go-Live.” During an Epic Go-Live, project communications should state clearly how legitimate account setup works and that IT will never ask for a password by email.
At-the-elbow support analysts can reinforce that message. When users ask whether an email about their new account is real, analysts can direct them to the reporting process instead of guessing, and remind them that support staff will never need their password to help them.
🎓 CAHIMS / CPHIMS & HIMSS Perspective
CAHIMS Exam Domain Mapping
Phishing is a core security awareness topic across the exam:
| CAHIMS Domain | How Phishing Appears |
|---|---|
| Healthcare & Technology Environments | Threat landscape in healthcare; HHS 405(d) and HICP; relationship to ransomware |
| Clinical Informatics | Security awareness for clinical users; protecting PHI in clinical communication |
| Healthcare Information & Systems Management | Email security, multifactor authentication, identity and access management, incident response |
| Management & Leadership | Security awareness programs, simulation metrics, HIPAA risk analysis, breach response |
Key Terms to Know Alongside Phishing
- Social Engineering — manipulating people into breaking security practices or revealing information
- Spear Phishing — a targeted phishing message tailored to a specific person or role
- Multifactor Authentication (MFA) — verifying identity with two or more independent factors, such as a password and a security key
- Business Email Compromise (BEC) — fraud that uses a hijacked or spoofed email account to redirect money or data
- DMARC — an email authentication policy that helps receiving servers reject messages that spoof a domain
- Ransomware — malware that encrypts systems or data and demands payment, often delivered through phishing
HIMSS Organizational Position
HIMSS treats cybersecurity as a patient safety issue. Its Healthcare Cybersecurity Community brings together security leaders and clinicians to share practices for defending against threats such as phishing and ransomware, and HIMSS engages on cybersecurity policy through its public policy work. Members can find related education and research through the HIMSS Resource Center.
🔗 Explore Further: External References
- HHS 405(d) Program — Health Industry Cybersecurity Practices (HICP) https://405d.hhs.gov/
- NIST — Phishing (Small Business Cybersecurity Corner) https://www.nist.gov/itl/smallbusinesscyber/guidance-topic/phishing
- UK National Cyber Security Centre — Phishing Attacks: Defending Your Organisation https://www.ncsc.gov.uk/guidance/phishing
- Gordon et al. (2019), JAMA Network Open — Assessment of Employee Susceptibility to Phishing Attacks at US Health Care Institutions https://pubmed.ncbi.nlm.nih.gov/30848810/
- Gordon et al. (2019), JAMIA — Evaluation of a Mandatory Phishing Training Program for High-Risk Employees https://pubmed.ncbi.nlm.nih.gov/30861069/
- HIMSS — Healthcare Cybersecurity Community https://www.himss.org/networking/communities/healthcare-cybersecurity/
Term source: HIMSS Dictionary of Health Information and Technology Terms, Acronyms, and Organizations, 6th Edition (2025). All definitions in this series are paraphrased for editorial purposes. Readers are encouraged to consult the primary source for exact language.
Eric Andrew Kristof, RN, CAHIMS is a Healthcare IT professional and HIMSS Arkansas Chapter member based in Hot Springs Village, AR, with hands-on Epic Go-Live experience and a diverse healthcare and IT background. He writes at kristof.org at the intersection of clinical care and healthcare technology.
Leave a Reply