Two federal agencies have recently issued warnings about scams targeting physicians that use deceptive schemes and other nefarious means in attempts to gain access to medical records or personal information and even to fraudulently obtain payments.
In one scheme, the scammer—presumably seeking personal information—impersonates a Drug Enforcement Administration (DEA) agent and tells physicians that they are under investigation.
The DEA alert reports that both DEA-registrant and nonregistrant physicians have been contacted by scammers via letters and telephone calls in this scheme.
“It is not the DEA’s practice to call registrants regarding investigative matters,” says the DEA alert (PDF).
In the other scheme, the Centers for Medicare & Medicaid Services (CMS) says Medicare providers and suppliers are being targeted and are receiving requests for medical records or payment of alleged Medicare debts.
“CMS generally doesn’t initiate audits via fax or email unless a provider requests it,” says the alert, available on this CMS webpage at this article’s deadline. “Medicare overpayment collections are handled through an established process through the Medicare Administrative Contractors (MACs).”
CMS recommends that physicians avoid responding to suspicious requests and suggests they work with their Medical Review Contractor to confirm if a medical records request is real.
The DEA requests that incidents be reported to the FBI. Incidents can also be reported to the Federal Trade Commission, which takes reports and shares the information with more than 3,000 law enforcement agencies.
“Reporting these scams will help authorities find, arrest, and stop the criminals engaged in this fraud,” the DEA alert says.
“As a reminder, DEA personnel will never contact registrants or members of the public to demand money or any other form of payment, will never request personal or sensitive information, and will only notify people of a legitimate investigation or legal action in person or by official letter,” the alert adds. “In fact, federal law enforcement officers are prohibited from demanding cash or gift cards from a member of the public.”
Subscribe to free AMA email newsletters
Get the latest news from the AMA on the topics that matter to you—delivered to your inbox.
Awareness and caution required
Malicious hackers often break into systems simply by asking to be let in and finding a willing person who is happy to oblige. Cybercriminals use social engineering techniques to deceive people into divulging personal information. These include phishing emails that ask you to download harmless-looking attachments or click on an innocent-appearing link that leads to the downloading of dangerous malware.
“The best deterrence against these bad actors is awareness and caution,” the DEA alert says.
The AMA notes that effective cybersecurity preparedness and resiliency requires a team effort to build a shared culture of security awareness.
“Building that culture requires regular training to help physicians and staff members recognize and avert phishing attacks, ransomware and other types of malware and spyware, and a host of other threats,” AMA Immediate Past President Bruce A. Scott, MD, wrote in a Leadership Viewpoints column detailing why cybersecurity must be an essential element of every physician practice.
The AMA has physician cybersecurity resources and detailed tips for protecting patient health records and other data from cyberattacks.
