By Eric Andrew Kristof, RN, CAHIMS | Healthcare IT Professional | HIMSS Arkansas Chapter Member
About This Series: The HIMSS Word of the Day is a running blog series drawing from the HIMSS Dictionary of Health Information and Technology Terms, Acronyms, and Organizations, 6th Edition (2025) — the authoritative reference for healthcare IT professionals and the primary study resource for CAHIMS and CPHIMS certification. Each post paraphrases the term in plain language, grounds it in real-world healthcare IT context, and adds a bedside nursing perspective you won’t find in a textbook.
📖 The Term: Social Engineering
Source: HIMSS Dictionary of Health Information and Technology Terms, Acronyms, and Organizations, 6th Edition (2025)
🔍 Plain-Language Definition
Social engineering is the use of deception and psychological manipulation to persuade people to reveal confidential information, grant access, or take actions that compromise security. Rather than exploiting software flaws, it exploits human trust, helpfulness, fear, and urgency.
The HIMSS Dictionary describes social engineering as an attack vector that depends heavily on human interaction, typically manipulating people into bypassing normal security procedures so the attacker can reach systems, networks, or physical locations.
| Tactic | How It Works | Healthcare Example |
|---|---|---|
| Phishing | Deceptive emails that lure users to click, open, or enter credentials | A fake message about a payroll change or EHR password expiration |
| Vishing | Voice calls impersonating trusted people | A caller claiming to be from IT asks for a login code |
| Smishing | Text messages with malicious links | A text about a missed delivery or account lock |
| Pretexting | A fabricated scenario to justify a request | Someone posing as a physician requesting patient information |
| Help Desk Impersonation | Attackers call support to reset passwords or MFA | A caller pretending to be an employee asks to enroll a new phone |
| Tailgating | Following authorized people into secure areas | A stranger enters a medication room behind a staff member |
⚠️ Exam Alert: Social engineering is the broad category of manipulating people. Phishing is the most common form, delivered by email. Spear phishing targets specific individuals with tailored messages. Pretexting relies on a made-up story. Tailgating is a physical social engineering tactic. HIPAA requires security awareness training.
🌐 Why It Matters: Real-World Healthcare IT Context
People are often the easiest path into an organization. Strong technical defenses can be bypassed if an employee provides a password, approves a fraudulent multifactor authentication prompt, or installs malicious software after being tricked. Many ransomware and data theft incidents begin with social engineering.
Healthcare is an attractive target. Hospitals have large workforces, many temporary and rotating staff, constant communication by phone and email, and a culture of helping quickly. Clinicians are trained to respond to urgent needs, which attackers exploit by creating false urgency. Health records and access to clinical systems are valuable to criminals.
Attackers have targeted IT help desks. Federal health cybersecurity advisories have warned about attackers calling hospital help desks while impersonating employees, often clinical or finance staff, to request password resets and enroll new devices for multifactor authentication. Once enrolled, attackers can access email and other systems. Strong identity verification for help desk requests has become an important defense.
Techniques continue to evolve. Attackers use information from social media and public websites to craft convincing messages, send multifactor authentication prompts repeatedly until a user approves one, and increasingly use AI-generated text and even synthetic voices to impersonate leaders or colleagues.
Physical social engineering matters too. Hospitals are open environments where visitors move freely. Tailgating into restricted areas, posing as vendors or technicians, or accessing unattended workstations can lead to theft of devices, data, or medications.
Financial fraud is a related risk. In business email compromise schemes, attackers impersonate executives or vendors and ask staff to change payment instructions or wire funds. Healthcare organizations, with many suppliers and complex payment processes, have been targeted, and callback verification using known contact information is a simple, effective control.
Defenses combine technology, process, and culture. Email filtering, phishing-resistant multifactor authentication, verification procedures for sensitive requests, and physical access controls reduce risk. Security awareness training, simulated phishing exercises, and easy reporting tools help staff recognize and report attempts. A culture where questioning unusual requests is welcomed, even when they appear to come from leaders, is essential.
The HHS 405(d) program’s Health Industry Cybersecurity Practices identify email system vulnerabilities, including phishing, among the most significant threats to healthcare organizations and recommend practical defenses for organizations of all sizes. The FBI’s Internet Crime Complaint Center also collects reports of fraud such as business email compromise.
Common social engineering warning signs:
- Unexpected urgency or pressure to act immediately
- Requests to bypass normal procedures
- Requests for passwords, codes, or MFA approvals
- Unusual sender addresses or slightly misspelled domains
- Callers who cannot be verified through known numbers
- Strangers in restricted areas without visible identification
Defenses against social engineering:
- Phishing-resistant multifactor authentication
- Strict identity verification for help desk requests
- Security awareness training and phishing simulations
- Simple, fast reporting of suspicious messages
- Badge access and challenge culture for restricted areas
- Callback verification for financial or data requests
🏥 The Nurse’s Perspective: Clinical, Bedside, & Workflow
Nurses are frequent targets of social engineering and can be a strong line of defense.
At the Bedside
Phone calls requesting patient information should be handled carefully. Verifying the caller’s identity and role, using known numbers to call back when needed, and following organizational policies help prevent pretexting attempts to obtain PHI.
Strangers in restricted areas, such as medication rooms or staff-only spaces, should be politely questioned or reported to security. Holding secure doors for unknown people, even to be helpful, can allow unauthorized access.
In Clinical Workflow
Emails and texts that create urgency, such as messages about account suspension, payroll changes, or urgent requests from leaders, deserve skepticism. Pausing to verify through a separate channel helps avoid falling for a convincing message.
Multifactor authentication prompts that appear without a login attempt should be denied and reported. Approving an unexpected prompt can give an attacker access to email or clinical systems.
Never sharing passwords or login codes, even with someone claiming to be from IT, is a simple rule that blocks many attacks. Legitimate IT staff do not need a user’s password.
Reporting suspicious activity quickly helps security teams protect others. A single report can lead to blocking a phishing campaign before others are harmed.
Personal information shared online can fuel targeted attacks. Limiting public details about work roles, schedules, and organizational systems on social media makes it harder for attackers to craft convincing messages.
In EHR Implementation (Go-Live Perspective)
During an Epic Go-Live, many emails about training, accounts, and new devices circulate, and many unfamiliar support staff are present. Attackers may exploit this confusion with fake messages or by impersonating support personnel.
At-the-elbow support analysts typically wear clear identification and never ask for passwords. Communicating this to staff in advance helps nurses recognize legitimate support and report anyone acting suspiciously.
🎓 CAHIMS / CPHIMS & HIMSS Perspective
CAHIMS Exam Domain Mapping
Social engineering appears in security awareness and risk questions:
| CAHIMS Domain | How Social Engineering Appears |
|---|---|
| Healthcare & Technology Environments | Threat landscape; HIPAA security awareness training requirements |
| Clinical Informatics | Clinician behaviors, phone requests for PHI, physical security on units |
| Healthcare Information & Systems Management | Email security, MFA, help desk verification, access controls |
| Management & Leadership | Training programs, security culture, incident response |
Key Terms to Know Alongside Social Engineering
- Phishing — deceptive emails designed to steal credentials or deliver malware
- Spear Phishing — phishing targeted at specific individuals using tailored information
- Pretexting — creating a false scenario to obtain information or access
- Vishing and Smishing — social engineering by voice call and text message
- Tailgating — following an authorized person into a secure area
- MFA Fatigue — repeated authentication prompts sent to pressure users into approving access
HIMSS Organizational Position
HIMSS treats people-focused threats such as social engineering as core cybersecurity risks and supports awareness and training through its Healthcare Cybersecurity Community and research. Members can find related education and research through the HIMSS Resource Center.
🔗 Explore Further: External References
- NIST — Glossary: Social Engineering https://csrc.nist.gov/glossary/term/social_engineering
- HHS 405(d) Program — Health Industry Cybersecurity Practices https://405d.hhs.gov/
- HHS — Cybersecurity Guidance (HIPAA) https://www.hhs.gov/hipaa/for-professionals/security/guidance/cybersecurity/index.html
- FBI — Internet Crime Complaint Center (IC3) https://www.ic3.gov/
- HHS — The Security Rule https://www.hhs.gov/hipaa/for-professionals/security/index.html
- HIMSS — Healthcare Cybersecurity Community https://www.himss.org/networking/communities/healthcare-cybersecurity/
Term source: HIMSS Dictionary of Health Information and Technology Terms, Acronyms, and Organizations, 6th Edition (2025). All definitions in this series are paraphrased for editorial purposes. Readers are encouraged to consult the primary source for exact language.
Eric Andrew Kristof, RN, CAHIMS is a Healthcare IT professional and HIMSS Arkansas Chapter member based in Hot Springs Village, AR, with hands-on Epic Go-Live experience and a diverse healthcare and IT background. He writes at kristof.org at the intersection of clinical care and healthcare technology.
Leave a Reply