What To Do When a Patient Reports a Scam Call

With security incidents on the rise, it’s easier for cybercriminals to obtain our patients’ information. Sometimes, scammers spoof Carilion phone numbers and pretend to be someone from Carilion to trick the patient into providing information or money.

If a patient tells you they received this kind of call, here are the steps you should take.

First, ask the patient for as much information as possible. This will help the Information Security team to follow up with you or the patient. Please gather as much of the following as you can:

1. Patient’s information – name, phone number, etc.
2. What company did the scammer pretend to be?
3. What name did the scammer give?
4. What phone number was shown on caller ID?
5. Did the patient confirm any of their information with the scam caller?
6. Did the patient provide any information to the scam caller?
7. Did the patient send any payment?
8. Ask the patient to give as much detail about the scam call as possible.

Then submit the information you have collected to either the Integrity Help Line at 1-844-732-6232 or to Information Risk Management at information_risk_management@carilionclinic.org.

Depending on the incident, the Information Risk Management team may:

• Work to determine if this is a legitimate call. For example, some patients may report a call from our business associates as a scam call, which is why question #2 above is helpful.
• Work with Privacy to determine if there is inappropriate access to the patient's medical record.
• Research known scams that align with this call.
• Report the scam call to the Federal Trade Commission.

Questions?

Contact Information Risk Management at information_risk_management@carilionclinic.org.