A message saying that medical results are ready can feel harder to ignore than an ordinary promotional email. You do not need to ignore your care to avoid a phishing attempt. Leave the message and open MyChart through your installed app or a previously verified bookmark, then check the correct healthcare organization’s account.
That independent route answers the security question without letting an unexpected email choose your login page. MyChart’s official fraud guidance describes criminals copying its name and branding, including fake result notifications and giveaway offers. Such impersonation does not, on its own, prove that your provider’s system was breached or that anyone has viewed your record. Your response should follow what you actually opened, disclosed or approved.
Start with the healthcare organization you use
MyChart is used by different healthcare organizations, so a recognizable product name is only part of the identification. Ask which hospital, practice or health system is supposed to have sent the notification. If you receive care from several organizations, check the relevant account rather than assuming that the first MyChart screen you recognize is the right one.
A fictional message might mention a recent appointment accurately enough to feel convincing. That detail is still a claim from the sender. Verify through the provider route you already use and look for the corresponding message or result there. If the notification cannot be matched, contact the organization’s help desk or care team through its established contact information.
Open the app without using the message
Close or leave the email, then launch the installed app yourself. On a computer, use your verified bookmark or reach the portal through the provider’s official website. Avoid using the email’s sign-in button to decide whether the email is real, because that leaves the sender in control of the route you are trying to verify.
If you do not know your organization’s portal address, MyChart’s official site provides a way to find participating organizations. Check that the organization is the one responsible for your care. Do not choose a similarly named result merely because it displays the same logo or asks familiar questions. A careful entry point is more useful than memorizing the appearance of a login form.
Do not turn one domain example into a universal rule
The official MyChart guidance explains that organizations have their own web addresses and that some message links use other documented domains. That means a short address is not automatically fraudulent, and a long address containing “mychart” is not automatically trustworthy. A rigid allowlist copied from an old post can create both false alarms and false confidence.
Use address inspection as supporting evidence, particularly when a brand appears in a misleading path or subdomain. For an uncertain health notification, the stronger practical choice is still to open your own portal route. You can avoid visiting the supplied destination while preserving access to legitimate messages inside the actual service.
Separate the medical question from the security question
A pop-up claiming that a test result is dangerous is not a clinical assessment. Do not change a medicine, pay for a treatment or download a special viewer because an unverified page tells you to act urgently. Verify the notification through the real portal and use your established care-team contact route for questions about a genuine result.
Equally, do not abandon a real care need because the notification looks suspicious. If you have a time-sensitive concern, use the provider’s normal urgent-contact instructions rather than waiting for the email’s authenticity to be settled. You are checking who sent the message. You are not using the appearance of that message to determine what care is needed.
A prize offer is a different request from a care notification
A supposed free health kit can lead to a survey and then a card form for shipping. MyChart’s fraud guidance identifies giveaway impersonation as a scam pattern. Before answering any questions, ask why an unexpected marketing page needs medical, identity or payment information and whether your provider has independently confirmed the offer.
Do not test the form with your real information to see what happens next. A page can receive information as you type or submit an early step, even if you never finish paying. If you already entered details, record which categories were involved. An incomplete checkout does not necessarily mean that every piece of information remained private.
Stop if a results page asks you to run something
A browser page asking you to paste a command into an operating-system window has crossed an important boundary. Stop rather than following the keyboard sequence. A result notification should not be used to persuade you to run an unknown program, defeat a security warning or install a tool supplied by that notification.
MyChart specifically warns about fake human-verification instructions and downloads in its fraud guidance. You do not need to reproduce or investigate the command yourself. If you already ran it, treat that as a device-security event and obtain appropriate technical help. Keep the description of what happened, but do not run the same instruction again to make a clearer screenshot.
If you only opened the page
Close it and stop interacting. Note whether it downloaded a file, asked for notification permission or prompted another action that you accepted. Opening a page and installing a program are different events. Your account is not proven compromised just because the message reached your inbox or a page briefly loaded.
Return to your own portal route and check for an actual message. If there was a download or other unexpected browser change, include it in your support report. Do not use a suspicious page’s “scan now” button to investigate the risk it created. The notification’s own reassurance is not an independent security check.
If you entered a password or verification code
Reset the exposed password through the genuine portal or the provider’s verified recovery process. Tell the organization’s help desk if you supplied a one-time code, approved a prompt or cannot regain access. Those details help it assess whether there may have been an active login, rather than treating the case as an unwanted email alone.
If the same password was used elsewhere, replace it on those accounts too. Pay particular attention to the email account used to recover portal access. Use a trusted device if you also ran an unknown program on the original one. Keep the new password and recovery codes out of the incident notes you send to other people.
Verify the contact details inside the real account
After recovering access, check that the email address and telephone number listed in your account are yours. A password change is less useful if future recovery messages go somewhere you do not control. If a field is unfamiliar or cannot be corrected, contact the healthcare organization’s support team through an independently verified route.
Distinguish an outdated number from evidence that an attacker changed it. Record what you can see and when you last knew the details were correct. You do not need to settle the cause before asking support to investigate. Accurate uncertainty is more useful than a confident explanation that the available evidence does not establish.
Review proxy access without disrupting legitimate help
Some people have authorized family members or caregivers to help manage their records. MyChart calls this proxy access, and the healthcare organization determines its rules and availability. An unfamiliar name deserves investigation, but a relative’s account or an age-related access change should not automatically be described as a hack.
Use the portal’s sharing controls where available and ask the organization about access you do not recognize. Avoid sharing your own password as a substitute for the supported proxy process. A helper should use the access the provider authorizes. That arrangement is easier to review and correct than several people signing in with the patient’s credentials.
Check connected apps as a separate access route
If you granted another app permission to receive health information, a password reset may not address that connection. MyChart documents a Linked Apps and Devices activity and access-history information. Review the options your organization provides and report an app you do not recognize rather than assuming that uninstalling it ends every connection.
MyChart’s guidance says revoking app access stops new information being shared; it does not promise to retract information already received. Record the app name and what permission you remember approving. If you are unsure which patient’s information was involved, explain that to support, especially when your account also has legitimate family proxy access.
Use the second-factor methods your portal supports
MyChart documents two-step verification using supported email, text or authenticator methods, with settings available through the account controls. Review the options in your actual portal and follow its prompts. Do not assume that every healthcare organization’s configuration or every MyChart-related account has identical settings.
Choose a method you can keep secure and recover. A second factor helps protect account access, but it does not make a fake page safe to receive a code. Keep the rule consistent: use codes only for the verified sign-in you initiated. A person calling to “cancel” an attack should not receive your live authentication code.
Report privately to the provider
Give the help desk the message subject, approximate time and what you did. You can describe a fake results claim without including the genuine result itself. Ask how it wants suspicious messages submitted and whether an account-access review is needed. Use the organization’s privacy contact if the concern involves possible disclosure of medical information.
Do not post patient numbers, result screenshots, full dates of birth or portal links with private tokens in a public discussion. HHS emphasizes protecting sensitive health information on personal devices as well as within healthcare services. A report intended to prevent exposure should not create another unnecessary copy of the record in an unrelated service.
Handle payment and identity exposure separately
If you entered a card on a fake giveaway or payment page, contact the card issuer promptly through a trusted route and explain the interaction. If you supplied insurance or identity details, tell the relevant organization which information was involved. A portal password change does not withdraw a card number or an identity document already disclosed.
Watch for unfamiliar bills or services and ask the healthcare provider to clarify questionable entries. HHS OIG advises checking medical bills and reporting suspected medical identity misuse. An unfamiliar charge can also be an error, so preserve the details and request clarification rather than deciding from a single line item that a particular person committed fraud.
Keep a safe route available for the next notification
Once the immediate issue is addressed, save the provider’s verified contact route and keep portal recovery details current. If a family member helps, make sure both of you understand the supported access arrangement. A short household rule works well: a notification can tell you to check for a message, but you open the account through your own route.
You can then keep receiving useful care notifications without accepting their links as instructions. Verify the right organization, protect the login and report the exposure that actually occurred. If care is time-sensitive, contact the established care team independently. Security checks should help you reach genuine care with less confusion.
Questions about MyChart phishing attempts
Does a fake MyChart email prove my health record was breached?
No. A copied brand or a message sent to your address does not establish access to a provider’s records. Check what you disclosed and ask the healthcare organization to investigate actual account concerns. Avoid presenting an impersonation attempt as a confirmed provider breach when that conclusion has not been verified.
Can genuine MyChart links use different addresses?
Yes. Organizations have their own portal addresses, and official guidance describes other domains used for messages. Do not trust or reject a notification based on one fragment alone. Open your installed app, a verified bookmark or the provider’s official site and check the relevant account there.
Should I download a viewer to open my result?
Do not install software offered by an unexpected result notification. Check your real portal and contact the provider if you cannot access a document there. If a fake page asked for an operating-system command, a security-warning bypass or a program installation, stop and report that request through the verified support route.
What if my password changed but another app still has access?
Review the supported connected-app controls and contact the organization about any connection you do not recognize. Password recovery and permission revocation address different routes. Revoking an app’s access can stop future sharing, but it does not establish what information the app already received or remove copies it may already hold.
Can a caregiver investigate by using my password?
Use the healthcare organization’s supported proxy arrangements instead of distributing the patient’s credentials. The provider can explain what a helper may access and how to review it. A caregiver can also assist with reaching official support without collecting passwords, authentication codes or private medical records into ordinary messages.