Security awareness training teaches home health staff to recognise suspicious emails. It almost never teaches them what to do in the fifteen minutes after they click on one anyway — because they were rushed, because the email looked convincing, because they were navigating to a patient home and confirmed the appointment link without thinking. Those fifteen minutes are the most consequential window in a phishing attack. The technical damage from a phishing click is rarely immediate — attackers typically need time to harvest credentials, establish persistence, and escalate access. Early, correct response in that window can contain an incident that would otherwise become a breach.
The six-step protocol below is written for distribution to home health staff — in plain language, without technical jargon, short enough to be read and remembered rather than filed and forgotten.
Step 1: Stop Everything You Are Doing on That Device
The moment you realise you may have clicked a malicious link or entered credentials on a suspicious page, stop using the device. Do not try to close the browser window. Do not try to delete the email. Do not restart the device. Do not try to find and remove whatever the link may have installed. Any action you take on the device — even well-intentioned action — can destroy the forensic evidence that your security team needs to understand what happened, and may trigger additional malicious activity that was waiting for user interaction to proceed.
Put the device down. Pick up your phone if it is a separate device. Move to Step 2.
Step 2: Do Not Try to Fix It Yourself
The instinct to fix the problem quietly — to undo what happened, to make it as if the click never occurred — is understandable and consistently makes situations worse. Staff who delete suspicious emails before reporting them destroy evidence. Staff who attempt to change their own passwords before contacting IT may trigger account lockouts that complicate the response. Staff who restart devices to "clear" whatever was installed lose forensic data that incident responders need.
You are not in trouble for clicking a suspicious link. Phishing emails are designed by professionals to be convincing. The only thing that creates a problem is not reporting it. The five minutes you spend trying to fix it quietly are five minutes the attacker has to deepen their access.
Step 3: Call Your Security Contact Immediately
Every home health staff member should have a single phone number memorised or saved in their personal phone: the IT security helpdesk or the managed security provider's direct line. Not the main office number. Not a colleague's email. The specific number that reaches someone who can act on a phishing report immediately. At ShieldForce-managed agencies, this is our 24/7 security operations line, answered by a human analyst who understands healthcare context.