MyChart Medicare phishing scam raises concern among Philadelphia health systems
Pa. Attorney General David Sunday is urging residents to beware of unsolicited free offers and rewards.
Philadelphia-area health systems are warning residents to beware of an online phishing scam that mimics MyChart, the secure online patient portal used by most leading health systems.
The scam involves emails and text messages that encourage people to claim a “MyChart Medicare Kit” by clicking on the embedded link to complete a survey. The resource kit is fictional, and clicking the malicious link could give hackers access to their MyChart portal, which stores identification information, including birth dates and addresses, and private health details, such as medications, medical conditions, and doctor conversations.
Penn Medicine, Jefferson Health, Temple Health, Main Line Health, and Virtua are among the local systems that have posted warnings on their websites and sent notices to patients urging them to not to share passwords or other personal information through email links.
Attorney General David Sunday has also urged people to “stay on the lookout for this new scam tactic.”
Phishing emails are becoming more sophisticated, as artificial intelligence does away with misspellings, grammatical errors, and graphics irregularities that were once telltale signs of a scam.
Phishing attacks have grown more than 40-fold since ChatGPT, an AI program that can draft emails and letters based on a prompt, was introduced in 2022, according to a 2026 trend report from HoxHunt, a cybersecurity risk management and training company.
Scams that relate to people’s healthcare or insurance can be especially dangerous because of the type of information they may expose and because of the urgency people may feel to respond to the message, said Tom Gordon, chief information officer at Virtua Health.
“The leverage with healthcare is you’re going to have a certain reaction,” Gordon said. “It drives an emotion, it affects people’s defenses.
Philadelphia hospitals take action
Philadelphia-area health systems work together to track scams and alert patients, said Lou Dignam, Virtua’s vice president of cybersecurity.
Virtua is part of Health Information Sharing and Analysis Center, known as Health-ISAC, a nonprofit membership organization for hospitals, insurers, pharmaceutical companies, and other health security professionals across the country to share real-time threats and best practices.
When Digman and Gordon heard about the MyChart Medicare scam, they turned to their group chat with security officers at Penn, Jefferson, Cooper, Inspira, Main Line Health, and others. They talked about what to do, even coordinating what to write in online notices and emails to patients.
“People may look at these organizations as competitors, but on this type of thing, it’s very collaborative and unified,” Gordon said.
Cohesive communication across health systems is especially valuable in the Philadelphia area, where a high concentration of providers means patients may see doctors at multiple systems, he said.
Their main message: Always be curious and cautious.
How to avoid phishing scams
Cybersecurity experts say vigilance is the best protection against phishing scams.
“Scammers are always looking for new ways to obtain as much of your personal information as possible,” Attorney General Sunday said in a statement.
Sunday and Gordon offered consumers some tips:
Be skeptical of unsolicited free offers and rewards.
Hover over email addresses and links, which can be disguised to appear to be from a trusted sender.
Avoid clicking links in emails and text messages. Instead, go directly to the website or mobile application.
Do not “unsubscribe” from emails that you suspect could be phishing attempts, as the “unsubscribe” link could also be malicious. Instead, delete the email.
Report phishing attempts sent to work email to your employer.
