Skip to main content
Back to practice
Tracing Care

Real stories · Simple habits

Stay safe with your health information

Your health information is valuable, and criminals know it. These true stories show how health care scams and hacks happen, and the simple habits that help protect you.

These are real stories from government offices and news outlets, with links so you can read more. Tracing Care is a practice project and isn't connected to any company named here.

True stories

Scam emails and texts · August 2026

Fake "MyChart Medicare Kit" messages

MyChart is a patient portal that many hospitals and clinics use. In August 2026, more than a dozen hospital groups warned patients about fake emails and texts. Pennsylvania's Attorney General did too. The messages used the MyChart name and logo. Many said the person had won a "MyChart Medicare Kit" or another prize. There is no such prize.

The goal was to get people to click a link and type in their MyChart password and personal details. Then scammers could get into their accounts. The company that makes MyChart did not send these messages.

What officials advised

Don't click any links in these messages, not even "unsubscribe." Don't reply, and never share your password or sign-in codes. Use only your medical team's official MyChart app or website. If you're not sure how to reach it, call your medical office.

Data hack · February 2024

One hack touched about 190 million people

In February 2024, criminals broke into Change Healthcare. This company helps doctors and hospitals send bills to insurance. Most people had never heard of it, but their information passed through it. The company said data for about 190 million people may have been taken. Later, it raised that number to about 193 million. That's more than half the people in the United States.

The stolen information could include phone numbers and addresses, health insurance details, health information, and billing records.

What this teaches

Your information can be exposed even if you did nothing wrong. That's why it helps to watch your health statements and bills for anything you don't recognize.

Ransomware · February to March 2026

Hackers demanded $800,000 from a hospital

In February 2026, hackers attacked the University of Mississippi Medical Center with ransomware. Ransomware locks up a computer system until the victim pays. The hospital closed clinics across the state and canceled surgeries. Staff used backup plans to keep caring for patients.

In March, a criminal group said it had stolen the hospital's data. It asked for $800,000 and threatened to post the data online. The group posted on the dark web. That's a hidden part of the internet where stolen data is traded. One news report said the post also offered the data for sale. The hospital did not comment. It had not said whether patient data was taken.

What this teaches

To criminals, health data is something to use or sell. That's why protecting your accounts and watching your statements matters.

Why is health information worth money?

It's hard to replace

You can cancel a credit card, but you can't change your birth date or your health history. Once health information is stolen, it can be misused for a long time.

It can be used in your name

A thief with your Medicare or insurance number can get care or medicine in your name. They can also send fake bills to your insurance or leave you with medical debt.

It can change your records

A thief's visits can end up in your medical record. That can lead to wrong information when you need care.

A data breach is when private information gets stolen or exposed. In both 2024 and 2025, health data breaches in the U.S. affected more than 100 million people each year. Most were caused by hacking.

Habits that keep you safe

  1. Open your portal yourself. Use the app or a website you saved. Don't sign in through links in emails or text messages, even if they look real.
  2. Check who sent it. Scam messages often come from addresses that don't match your clinic, or offer prizes and rewards. Rushed or "too good to be true" messages are warning signs.
  3. Never share your password or sign-in codes. Don't send them by phone, text, or email, even if the message looks like it's from your clinic.
  4. Turn on two-step sign-in if your portal offers it. Each time you sign in, it sends a code to your phone. Then a stolen password isn't enough to get in.
  5. Guard your Medicare and insurance numbers like a credit card. Don't give them for "free" health kits, surveys, or offers you didn't ask for.
  6. Read your statements. Your insurance or Medicare sends statements that list the care you got. They may be called an Explanation of Benefits or a Medicare Summary Notice. Look for visits, tests, or equipment you never had.
  7. When in doubt, hang up and call back. Use a number you trust: the one on your insurance card, your bill, or your clinic's official website.

Practice spotting scams

If something feels wrong

  • Someone used your information: report it at IdentityTheft.gov (opens in a new tab) or call 1-877-438-4338. You'll get a step-by-step recovery plan.
  • Medicare fraud: call 1-800-MEDICARE (1-800-633-4227).
  • Scam texts: forward them to 7726 (it spells SPAM), then delete them.
  • Any scam: report it at ReportFraud.ftc.gov (opens in a new tab).
  • Want to talk to someone? The AARP Fraud Watch Network Helpline offers free help: 877-908-3360, Monday to Friday, 8 a.m. to 8 p.m. Eastern.

Read more

Last checked October 2026. Phone numbers and websites can change, so check the official site if a number doesn't work.