Phishing is a deceptive message designed to make someone reveal information, open a harmful link, download software, or take another action that benefits an attacker. In a healthcare workplace, the message may imitate a technology team, colleague, supplier, or familiar service.
NIST emphasizes that phishing is not limited to email. It can arrive through text messages, phone calls, social media, and other channels. A message can sound professional and still be fraudulent.
Look at the request
A useful question is whether the requested action makes sense through this channel. Unexpected requests to sign in, provide credentials, approve access, or open a file deserve verification. Urgency can be part of the deception: the message may claim that access will be lost unless the recipient acts immediately.
NIST advises verifying unusual requests using known contact information or an independently located official source, rather than contact details supplied in the suspicious message. A familiar display name or logo is not enough to establish authenticity.
HHS's cybersecurity guidance describes attackers imitating support personnel and using fake sign-in pages to obtain credentials. In nursing workflows, this matters because compromised access may expose patient information or disrupt the systems needed for care.
Use the workplace reporting route
Follow the organization's process for reporting suspicious messages. Do not reply to the sender for confirmation or forward the message widely to colleagues. If a reporting tool is available, use it as instructed so the security team receives the information it needs.
If you already clicked, downloaded, entered information, or approved an unexpected request, report that promptly and accurately. NIST recommends following the organization's incident-response plan and changing affected passwords as appropriate. In a managed clinical environment, coordinate recovery with the authorized support team rather than improvising technical changes.
Illustrative verification
The example is invented and does not depict a real system. A familiar name or urgent request does not settle authenticity. Verify through a known route and follow the workplace reporting process for suspicious messages.
An illustrative text message says that a nurse's scheduling account will be suspended and provides a sign-in link. Instead of using the link or the number in the message, the nurse opens the approved scheduling application or contacts the service through the established directory.
The example does not prove that every urgent message is fraudulent. It shows how independent verification can answer the question without first giving the sender access or information.
Build a response that supports reporting
A local education program should show realistic examples and explain the reporting steps for each common communication channel. Include what to do after a mistake, because uncertainty about consequences can delay reporting.
Evaluate whether staff can find the reporting method and whether they receive useful follow-up. A training click rate alone does not describe how well the organization detects and contains real incidents.
NIST also recommends technical measures such as email protections, maintained security software, and multifactor authentication. Phishing prevention should not depend on every nurse perfectly identifying every deceptive message during a busy shift.
For the part nurses play after reporting a suspicious message, see cybersecurity for nursing teams.
Related
Cybersecurity for Nursing Teams
Mobile Devices and Patient Information
Sources
-
NIST: Phishing (accessed 2026-09-17).
-
HHS: Health Industry Cybersecurity Practices (accessed 2026-09-17).