Cybersecurity training doesn’t always have to mean another long meeting.
A five-minute conversation during a staff meeting, morning huddle, or shift change can help employees think through the kinds of situations they may actually face, and reinforce what to do before they’re under pressure.
For Week 2 of Cybersecurity Awareness Month, here are four quick discussions you can use with your healthcare team.
How to use them: Read the scenario, ask the questions, and close with the takeaway. That’s it.
Huddle 1: The “Urgent” IT Request
The Scenario
You receive a call from someone who says they’re with IT.
They know your name and where you work. They tell you there’s a security problem with your account and you need to reset your password immediately using a link they send you.
Ask Your Team
- What would make you suspicious?
- What should you do before following the caller’s instructions?
- How would you verify that the request is legitimate?
The Takeaway
Attackers often create urgency so you’ll act before you have time to question the request.
If someone unexpectedly asks you to reset a password, change a security setting, provide a code, or take another sensitive action, stop and verify the request through a contact or process you already trust.
The habit: Pause. Verify. Then act.
Huddle 2: The Login You Didn’t Start
The Scenario
Your phone asks you to approve a multifactor authentication request.
You aren’t logging into anything.
A few minutes later, another request appears.
Ask Your Team
- What could be happening?
- Should you approve the request just to make the notifications stop?
- What should you do next?
The Takeaway
An unexpected MFA request can mean someone else is trying to access your account.
Deny the request and report it according to your organization’s procedures.
Never approve a login you didn’t initiate or share authentication codes with someone who contacts you unexpectedly.
The habit: If you didn’t start it, don’t approve it.
Huddle 3: “Just Text It to Me”
The Scenario
A coworker needs patient information quickly and says:
“Just text it to my personal phone. It’ll be faster.”
Everyone is busy, and the request seems harmless.
Ask Your Team
- What should you consider before sending the information?
- Is convenience enough reason to use a different tool?
- What should you do if you aren’t sure whether a communication method is approved?
The Takeaway
When patient information is involved, the fastest option isn’t always the right one.
Use the tools and processes your organization has approved. If you’re unsure, ask before creating your own workaround.
The habit: Before you send, check where it’s going.
Huddle 4: The EHR Is Down
The Scenario
You arrive at work and can’t access the EHR.
Other employees are having the same problem. Patients are arriving, phones are ringing, and everyone needs to keep working.
Ask Your Team
- What should you do first?
- Do you know where your organization’s downtime procedures are?
- What should you avoid doing while systems are unavailable?
The Takeaway
Cybersecurity isn’t only about preventing incidents. It’s also about knowing what to do when technology isn’t available.
Follow your organization’s downtime and incident-response procedures rather than creating unapproved workarounds.
The habit: Know the plan before you need it.
Five Minutes Can Reinforce a Habit
The goal of these conversations isn’t to turn every employee into a cybersecurity expert.
It’s to make good decisions easier to recognize and repeat.
That takes more than one annual training session.
HIPAA Secure Now’s PHIshMD Ongoing Training Program helps healthcare organizations reinforce cybersecurity habits throughout the year with weekly bite-sized training, simulated phishing, and ongoing visibility into employee risk.
Keep cybersecurity training going all year.
Learn More About PHIsh MD Training
Next week: We’ll turn the focus to healthcare leaders with a practical cybersecurity checkup to help you ask: Are the fundamentals actually working across your organization?
Leave a Reply