By Eric Andrew Kristof, RN, CAHIMS | Healthcare IT Professional | HIMSS Arkansas Chapter Member
About This Series: The HIMSS Word of the Day is a running blog series drawing from the HIMSS Dictionary of Health Information and Technology Terms, Acronyms, and Organizations, 6th Edition (2025) — the authoritative reference for healthcare IT professionals and the primary study resource for CAHIMS and CPHIMS certification. Each post paraphrases the term in plain language, grounds it in real-world healthcare IT context, and adds a bedside nursing perspective you won’t find in a textbook.
📖 The Term: Vishing (Voice or VoIP Phishing)
Source: HIMSS Dictionary of Health Information and Technology Terms, Acronyms, and Organizations, 6th Edition (2025)
🔍 Plain-Language Definition
Vishing, short for voice phishing, is a fraud tactic in which a caller uses voice technology to fool people into handing over sensitive financial or personal information. The HIMSS Dictionary notes that it works like phishing but is not limited to the internet, and may be carried out through voicemail, voice over IP (VoIP), landline, or cellular calls. It is a form of social engineering, which relies on persuading people and not on breaking software.
A vishing caller usually adopts a role that carries authority or creates urgency: the IT help desk reporting a problem, a bank fraud department, a vendor needing access, a physician or executive who “cannot get into the system,” or a payer asking for patient data. The goal may be a password, a multifactor code, remote access to a computer, a payment, or protected health information.
| Element | What Happens | Example |
|---|---|---|
| Pretext | Caller invents a believable role | “This is IT security; we detected a problem” |
| Pressure | Urgency or authority limits thinking | “Your account will be locked in ten minutes” |
| Request | Caller asks for a secret or an action | Read back a code, reset a password |
| Spoofing | Caller ID is falsified or voice is imitated | Number appears to be an internal extension |
| Follow-on | Stolen access is used | Login to email, VPN, or EHR |
⚠️ Exam Alert: Vishing uses voice; smishing uses text messages; phishing usually refers to email. All three are social engineering. The control that works across them is verification through a separate, known channel, backed by multifactor authentication and awareness training.
🌐 Why It Matters: Real-World Healthcare IT Context
Health care is an attractive target. Staff are busy, trained to be helpful, and often work with urgency. Help desks reset passwords and unlock accounts for many people. Hospitals depend on phones for clinical communication, and VoIP systems connect those calls to the same networks as other systems. A convincing voice can sidestep technical controls by persuading a person to open the door.
Vishing is hard to study because calls are ephemeral and recordings of real attacks are sensitive. A 2026 article in Scientific Data describes VISHGUARD, a multilingual synthetic audio corpus for research on persuasion-aware vishing detection. It contains 3,000 simulated phone calls in English, French, and Modern Standard Arabic, evenly divided between fraudulent and legitimate calls, each 10 to 90 seconds long. The calls are annotated for persuasion strategy, interactional markers, and emotional tone, and they were generated with text-to-speech synthesis and mixed with ambient noise to approximate office, street, and home settings. The authors note that the recordings approximate acoustic variety but not full telecommunication-channel effects. The dataset does not describe how often vishing succeeds in hospitals. Its value is for researchers building detection tools that look not only at words but at how persuasion unfolds in a conversation. The synthetic design also means that results from systems trained on it need testing on real calls before anyone relies on them.
Regulation shapes defenses. The HIPAA Security Rule requires covered entities and business associates to implement a security awareness and training program for all members of the workforce, including management, under 45 CFR 164.308(a)(5). It also requires procedures to verify that a person seeking access to electronic protected health information is the one claimed, under 164.312(d), and policies for authorizing access under 164.308(a)(4). Vishing tests all three: staff training, identity verification, and access authorization. NIST and national cybersecurity agencies publish practical phishing guidance that applies to calls as well as email, advising people to slow down, verify requests independently, and report suspicious contacts.
Defense is mostly procedural. Help desks need a firm identity verification process for password resets and multifactor changes, and the process must hold even when the caller sounds distressed or senior. Staff should know that no legitimate caller needs their password or a one-time code. The rule of thumb is to end the call and call back on a number from an official directory, not one the caller supplies. Finance and payroll teams need call-back checks for any request to change bank details. Organizations should make reporting easy and blameless, because the first person who suspects a call is the best early warning for everyone else. Exercises that include voice scenarios help staff practice. Technical controls, such as phishing-resistant multifactor authentication, number-of-attempt limits, alerts on password resets and new devices, and logging of help desk actions, limit the damage if someone is fooled.
Common vishing weak points:
- Help desk resets approved on the strength of a confident voice
- Staff who feel unable to challenge a caller who claims authority
- Caller ID treated as proof of identity
- Training that covers email but not phone scenarios
- Multifactor codes that can be read aloud or approved by mistake
- No simple way to report a suspicious call
What supports resilience:
- Documented identity verification for every account reset
- Call-back procedures using known numbers
- Training and drills that include voice scenarios
- Phishing-resistant multifactor authentication where possible
- Alerts on resets, new devices, and unusual access
- A no-blame reporting path and fast incident response
🏥 The Nurse’s Perspective: Clinical, Bedside, & Workflow
Nurses and unit clerks answer phones all day, which makes them targets and also a line of defense.
At the Bedside
A caller may claim to be a physician, a pharmacy, an insurance representative, or IT and ask for patient information or a login. Nurses protect patients by verifying who is asking before sharing anything: taking a number, checking it against a directory, and calling back. Declining politely is part of the job, and no one should feel rude for it. A call asking someone to approve a multifactor prompt or read a code is a warning sign.
In Clinical Workflow
Nurse managers include phone scenarios in huddles and make clear that staff will be supported for reporting. Units set rules for what may be shared by phone and what must go through verified channels. Charge nurses help new staff who may be especially susceptible to authority pressure.
Nurse informaticists work with security teams to design workflows that reduce risk, such as ensuring that password reset steps are quick and well-known so staff are not tempted to share credentials, and that downtime procedures do not rely on unverified phone requests.
In EHR Implementation (Go-Live Perspective)
An Epic Go-Live creates ideal conditions for vishing: many new accounts, new passwords, and many people who expect calls from support. At-the-elbow support analysts and command-center staff can state clearly how real support will contact users, and that they will never ask for a password or code by phone. Posting that guidance on badges, screens, and huddle boards helps staff recognize an imposter.
🎓 CAHIMS / CPHIMS & HIMSS Perspective
CAHIMS Exam Domain Mapping
Vishing appears in security, privacy, and awareness questions:
| CAHIMS Domain | How Vishing Appears |
|---|---|
| Healthcare & Technology Environments | HIPAA Security Rule, threat landscape, workforce training |
| Clinical Informatics | Workflow design that supports safe verification |
| Healthcare Information & Systems Management | Help desk procedures, multifactor authentication, VoIP security |
| Management & Leadership | Awareness programs, incident response, culture of reporting |
Key Terms to Know Alongside Vishing
- Social Engineering — manipulation of people to gain access or information
- Phishing — fraudulent messages, usually by email, that trick people into acting
- Smishing — phishing delivered by text message
- Caller ID Spoofing — falsifying the number or name that appears on a call
- Multifactor Authentication — verification using two or more types of evidence
- Security Awareness Training — education that helps workforce members recognize threats
HIMSS Organizational Position
HIMSS supports healthcare cybersecurity through its Healthcare Cybersecurity Community, research, and education. Members can find related resources through the HIMSS Healthcare Cybersecurity Community page.
🔗 Explore Further: External References
- Hmimou et al. (2026), Scientific Data — A Multilingual Behavioral Speech Dataset for Vishing and Social Engineering Detection https://pubmed.ncbi.nlm.nih.gov/42373678/
- eCFR — 45 CFR 164.308, Administrative Safeguards https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.308
- eCFR — 45 CFR 164.312, Technical Safeguards https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.312
- NIST — Phishing Guidance https://www.nist.gov/itl/smallbusinesscyber/guidance-topic/phishing
- UK NCSC — Phishing Attacks: Defending Your Organisation https://www.ncsc.gov.uk/guidance/phishing
- HHS 405(d) Program — Health Industry Cybersecurity Practices https://405d.hhs.gov/
Term source: HIMSS Dictionary of Health Information and Technology Terms, Acronyms, and Organizations, 6th Edition (2025). All definitions in this series are paraphrased for editorial purposes. Readers are encouraged to consult the primary source for exact language.
Eric Andrew Kristof, RN, CAHIMS is a Healthcare IT professional and HIMSS Arkansas Chapter member based in Hot Springs Village, AR, with hands-on Epic Go-Live experience and a diverse healthcare and IT background. He writes at kristof.org at the intersection of clinical care and healthcare technology.
Leave a Reply