Email Phishing Attacks: SLAM Method for HIPAA IT Management

An email phishing attack is when a cybercriminal poses as a trustworthy colleague, acquaintance, or organization and sends fraudulent emails to individuals or organizations to deceive them into revealing sensitive information (e.g., login credentials, financial data, personal information) or performing specific actions (e.g., clicking malicious links, downloading malware-infected attachments).

Phishing emails often mimic communications from trusted entities, such as banks, government agencies, or well-known companies, to trick recipients into believing they’re legitimate.

These emails typically employ various social engineering techniques to create a sense of urgency, curiosity, or fear, prompting recipients to take immediate action without critically assessing the email's authenticity.

Read More: How Many of Your Employees Would Actually Click That Link?



Why Are Email Phishing Attacks So Common?

Good question. If phishing attacks have been a known problem for the past two decades, why do they still run rampant now?

And the answer is: the widespread use of email technology.

With billions of email users worldwide, email has become an indispensable means of communication for individuals, businesses, and organizations. This makes it an attractive target for cybercriminals seeking to exploit its reach and accessibility.

The sheer volume of emails exchanged daily creates a vast attack surface for phishing attempts. Cybercriminals leverage this to cast a wide net, targeting a diverse range of recipients with fraudulent emails designed to deceive and manipulate.

Whether it's an unsuspecting individual, a large corporation, or a healthcare practice like yours, no one is immune to the threat of phishing attacks.

It’s important to note that healthcare practice owners face significantly higher stakes in an email phishing attack than typical business owners due to the nature of the data they handle and the strict regulatory requirements they must adhere to.

Violations of regulations such as the Health Insurance Portability and Accountability Act (HIPAA) can result in hefty fines, legal penalties, and damage to the practice's reputation. 

Unfortunately, according to IBM Security Chief People Hacker Stephanie Carruthers, “It really just takes one employee to click a link, give their credentials, or open up an attachment that could lead to a total compromise.”

Read More: Email Security Best Practices to Protect You From Phishing Attacks

SLAM Method: Meaning and Purpose

As a healthcare practice owner, safeguarding sensitive patient data from email phishing attacks is paramount to maintaining trust, regulatory compliance, and the integrity of your practice. One effective strategy for combating these threats is the SLAM method cybersecurity strategy.

Compliance management software company Compliancy Group defines the SLAM method as an acronym healthcare organizations can use to identify possible phishing emails. Here’s what SLAM stands for:

Sender

The first step in the SLAM method is to scrutinize the email's sender. Verify their identity. Look for suspicious or unexpected email addresses, especially if they claim to be from reputable organizations or individuals.

Be wary of generic or misspelled sender names, as these are common tactics used by phishers to deceive recipients. If in doubt, contact the supposed sender through a trusted communication channel to confirm the email's authenticity.

Link

Phishing emails often contain links to malicious websites that steal login credentials or install malware on your device. Before clicking any links within an email, hover your mouse cursor over the link to get a preview of the destination URL.

Avoid clicking links if:

• They have URLs that look suspicious or redirect to unfamiliar websites
• They have shortened URLs, as they can obscure the link's true destination
• You're unsure of their legitimacy

Attachment

Attachments in phishing emails can harbor malware or ransomware that can compromise your practice's network and sensitive data.

Never open email attachments from unknown or unexpected senders. Even if you do know the sender, don’t open email attachments if they’re unsolicited. Cyberattackers frequently exploit compromised email addresses to distribute harmful attachments to contacts.

Legitimate businesses typically do not send email attachments unsolicited. If you want to verify the authenticity of an email attachment, contact the sender directly to confirm the legitimacy of the attachment they supposedly sent.

Message

The content of the email itself can provide valuable clues about its legitimacy.

Be wary of emails that evoke a sense of urgency or fear. Phishers use these tactics to pressure recipients into taking hasty actions. Look for spelling and grammatical errors and inconsistencies in formatting or language, which may indicate that the email is fraudulent.

If the email requests sensitive information or prompts you to disclose login credentials, proceed cautiously and verify the request's legitimacy through alternative channels.

Read More: How to Use the SLAM Method to Combat Email Phishing Attacks

I Identified an Email Phishing Attack…Now What?

With the SLAM method, phishing emails are much easier to identify—but it doesn’t tell you what to do when you recognize one in your inbox. Here’s what Compliancy Group recommends:

Mark the Email as Spam

Most email clients provide an option to mark emails as spam or move them to a junk folder. By marking the phishing email as spam, you help train your email provider's spam filter to recognize similar malicious messages in the future, reducing the likelihood of them reaching your inbox or your colleagues.

Report the Phishing Attempt to Management

Informing management about the phishing attempt is essential to alerting other employees about the potential threat. This increases staff members' awareness and helps prevent others from falling victim to similar phishing attacks.

Your management team can also implement additional security measures or provide further training to mitigate future risks.

Report the Email to Your IT Department

Your IT department protects your organization's digital assets from cyber threats. Reporting the phishing email to them allows them to investigate the incident, analyze the threat, and take appropriate action.

They can also choose to block the sender's domain address, implement additional security measures, or provide guidance on handling similar incidents in the future.

If you don’t have an IT department, you may want to consider partnering with a trusted managed IT service provider specializing in healthcare IT.

ER Tech Pros, for example, leverages its cutting-edge technology and highly trained team of engineers to deliver comprehensive IT, cloud, cybersecurity, and compliance services to practices like yours.

Do Not Forward the Email to Anyone

It's crucial not to forward the phishing email to anyone, including colleagues or friends, as this could spread the threat further. Instead, follow the recommended reporting procedures outlined above to ensure that the incident is handled appropriately by the designated authorities.

Read More: Medical IT Cybersecurity: Safeguarding Patient Data

Cybersecurity Solutions Specially Prescribed for Healthcare

As the prevalence of email phishing attacks continues to rise, healthcare practices must remain vigilant in safeguarding patient data from malicious actors.

If you’re not sure your practice is fully equipped to handle an email phishing attack, you may want to consider ER Tech Pros' healthcare-specific cybersecurity services.

From endpoint security and dark web monitoring to cybersecurity awareness training and simulated phishing campaigns, we have what it takes to keep your data secure and your practice HIPAA compliant.