Research into email legitimacy perception shows that there are factors that increase susceptibility to phishing attacks. Healthcare organizations, in particular, are vulnerable to these attacks because of the volume of protected health information (PHI) they handle.
What is phishing?
Phishing is a cyberattack where attackers impersonate legitimate entities to deceive individuals into disclosing sensitive information, like passwords or financial details. The attackers usually send fraudulent emails with links to websites running malicious code or to download and install malware.
Factors that increase phishing susceptibility
Perceived sender legitimacy
According to an empirical investigation into how users make email response decisions, “how people perceive the sender’s legitimacy is pivotal in the trust they place in a received email. People tend to focus on specific components of the sender’s email address, sometimes, without even having a clear understanding of which components need more attention.”
For example, a study participant thought an email was legitimate based on the sender’s email display name only and stated “It is a bit dodgy. But I’m convinced it’s from PayPal [pointing to the sender’s email name].”
However, the participant failed to notice that the actual email address did not match PayPal's official domain, making them more susceptible to phishing scams.
Personal habits
Many individuals fall for phishing attacks because they “do not read the emails they get and believe it is easy to click on links without much thinking.”
For example, a participant revealed, “It’s in general when someone shares a document with me? I click it and look.”
Some people also experience stress from unopened emails in their inbox, stating, “If I was really busy, I would just click on the link.”
These personal habits prioritize convenience over caution, making people more likely to engage with malicious content.
Emotional triggers
Phishing attacks often exploit emotional responses like fear, urgency, or excitement, which can cloud judgment and lead to rushed decisions.
A participant shared their reaction to a worrying email: “This worries me because if my account is linked to PayPal, all my money will be easily transferred.”
Similarly, positive emotions like excitement about a job offer can lead users to accept offers without proper verification, “I’m so happy about the offer. I will respond soon, I’ll accept the offer.”
Overreliance on security tools
Some people think their computer's antivirus software will automatically protect them from phishing attacks, “There is something [antivirus software] to take care of this.”
However, their overreliance on antivirus software can create a false sense of security, making them overlook warning signs or check the authenticity of emails.
Misguided validation practices
Some people try to validate the legitimacy of an email by replying directly to it or clicking on links to observe the redirecting process.
“l want to click here ... I know that this is a scam email ... But I want to unsubscribe from this newsletter,” another study participant explained.
These interactions risk further compromise and increase exposure to malware or future phishing attempts.
Additionally, some people check online information or verify details against personal accounts, but these methods are not foolproof.
For example, one participant mentioned, “I can’t remember the color of the bank logo. I am going to search it up [on the internet].”
Lack of comprehensive training
Many users lack knowledge of phishing tactics and how to identify them. The study states that “people feel a sense of security” when an email has “auxiliary security content like if it says “it has been scanned by an external scanning tool,” even if they do not understand the role of a scanning tool.
So, inadequate training and awareness increase their vulnerability to more sophisticated phishing attempts.
Sophisticated phishing techniques
Phishers continually refine their methods to mimic legitimate organizations, making it harder for users to distinguish between real and fraudulent emails. They can use personalized information, realistic email designs, and convincing language to deceive even those who fell for phishing attempts before.
So, individuals must stay informed about the latest threats to avoid falling victim to sophisticated threats.
Security fatigue
Individuals can experience security fatigue over time, where the constant vigilance for identifying phishing attempts becomes overwhelming, making them more likely to miss details and fall for phishing scams.
More specifically, busy healthcare providers and organizations in the medical field may be particularly susceptible to security fatigue due to the high volume of emails and messages they receive daily, increasing the risk of overlooking potential phishing threats.
Research on the threats, mitigation, and approaches of phishing in healthcare organizations states, “Healthcare data have significant value as a potential target for hackers. Phishing is increasingly targeting healthcare organizations, but the scale of threat and awareness of staff remains largely undetermined.”
How HIPAA compliant emails prevent phishing
Encryption
Healthcare organizations must use a HIPAA compliant platform that encrypts emails during transit and at rest, protecting emails from being intercepted or altered by malicious actors.
Platforms like Paubox automatically encrypt emails without additional login steps or portals to help providers overcome security fatigue.
Integration with existing workflows
HIPAA compliant emails can be integrated with Google Workspace and Microsoft 365 so healthcare organizations can increase their security feature while keeping their existing workflows.
Additionally, integrating HIPAA compliant emails with these familiar email interfaces could help providers avoid suspicious portals that lead to phishing attacks.
Staff training
Healthcare organizations can use HIPAA compliant emails to send staff reminders for upcoming training on phishing attacks. These training sessions can include information on identifying and reporting suspicious emails, best practices for email security, and what to do in case of a data breach.
Advanced threat detection
Platforms like Paubox use advanced threat detection to identify and block phishing emails before they reach the inbox. It includes real-time scanning for malicious links, suspicious attachments, and known phishing patterns.
Furthermore, its machine learning and threat intelligence capabilities protect providers from sophisticated attacks.
DMARC support
Providers must use a HIPAA compliant platform that supports Domain-Based Message Authentication, Reporting & Conformance (DMARC) so only authorized senders can send emails on behalf of a domain.
DMARC authentication makes it more difficult for phishers to impersonate legitimate healthcare organizations.
Zero Trust security
Paubox uses a Zero Trust security model, so no email is automatically trusted, even if it comes from within the organization. Every email is subjected to authentication and security checks, minimizing the risk of phishing.
Read also: How do email phishing attacks impact HIPAA compliance?
FAQs
Does HIPAA apply to phishing attacks in healthcare?
Yes, phishing attacks in healthcare fall under Health Insurance Portability and Accountability Act (HIPAA) regulations. Phishing attacks compromising the privacy and security of protected health information (PHI) can lead to severe penalties, including fines and reputational damage.
Who needs to comply with HIPAA?
HIPAA compliance is required for covered entities, such as healthcare providers, health plans, and healthcare clearinghouses, as well as their business associates who handle protected health information (PHI).
How can providers make Google Workspace email HIPAA compliant?
Providers must use a Business or Enterprise plan, sign a business associate agreement (BAA) with Google, and use a HIPAA compliant platform, like Paubox, to protect patient information.
Subscribe to Paubox Weekly
Every Friday we'll bring you the most important news from Paubox. Our aim is to make you smarter, faster.