Pause. Verify. Report.

1. The urgent insurer email

“Your claims will be suspended today. Sign in using this link to restore access.” The message looks like your usual insurer.

Practical response: A familiar logo and urgent deadline do not establish who sent a message. Use your saved payer portal or a known contact route. Report suspicious messages through your practice’s process.

Team prompt: What is our approved process, and where can a new hire find it?

2. The new bank details

A supplier emails an invoice with a new bank account. “Please pay today; our old account is closed.”

Practical response: Verify payment changes outside the message, using contact details already on file. A reply can go to the same person who sent the request. Record who verified and approved the change before payment.

Team prompt: What is our approved process, and where can a new hire find it?

3. The surprise sign-in prompt

An MFA approval appears on your phone while you are checking in a patient. You did not try to sign in.

Practical response: Do not approve a sign-in you did not initiate. Report the unexpected prompt promptly using a known channel, and follow your IT team’s account-recovery instructions.

Team prompt: What is our approved process, and where can a new hire find it?

4. The urgent records request

Someone emails asking for a patient’s complete record immediately. They say the patient is waiting at another office.

Practical response: Urgency does not replace your records-release process. Verify the requester and use the approved sharing method. Ask the designated privacy lead when the request is unclear; do not place real patient information into this exercise.

Team prompt: What is our approved process, and where can a new hire find it?

5. The new hire without access

A new teammate needs to start work, but their account is not ready. They ask to borrow your login.

Practical response: Use the approved onboarding process and individual access. Shared logins make it harder to manage permissions and determine who did what. Ask the manager what work can proceed safely while access is arranged.

Team prompt: What is our approved process, and where can a new hire find it?

Leave with one concrete action

Write down your known IT/security contact, your payment-change approver and your privacy lead. Make the approved contact routes easy for the team to find. Do not put passwords or patient details on this sheet.