Your clinical staff know about phishing emails. They have completed annual security awareness training and have learned to look for suspicious links.
Your scheduling staff have not been told that they are one of the most targeted groups in home health cybersecurity — and the attacks aimed at them look nothing like a phishing email.
Social engineering is the art of manipulating people rather than systems. Attackers call, email, or message your scheduling department and manipulate staff into revealing information, changing records, or granting access. They don't need to bypass your firewall. They just need to convince your scheduler that they are a family member, a physician's office, or a Medicare auditor.
Why Scheduling Staff Are a Prime Target
Home health scheduling departments hold a combination of information that is extremely valuable to attackers:
- Patient names, addresses, and visit schedules (physical access intelligence)
- Treating physician names and contact information
- Insurance and payer information
- Staff schedules and nurse assignments (useful for further social engineering)
- Sometimes: EHR access credentials used for scheduling functions
A call to your scheduling department that successfully extracts a patient's name, address, insurer, and visiting nurse schedule gives an attacker enough information to impersonate the agency, the nurse, or the physician — and to target the patient or family directly.
The Four Social Engineering Scenarios Targeting Home Health Scheduling
Scenario 1: The Family Member Call
The setup: An attacker calls the scheduling department claiming to be a family member of a patient. They say they are the patient's daughter, they are concerned about today's visit, and they need to confirm the visiting nurse's name and arrival time.
Why it works: Scheduling staff are trained to be helpful to families. Confirming that "Nurse Johnson will be there at 2pm" feels like good customer service, not a security incident.
What the attacker does with it: The "family member" calls the patient's home, identifies themselves as calling on behalf of Nurse Johnson, and uses this information to conduct fraud — insurance fraud, identity theft, or a pretext to gain entry to the home.
The defense: Verify identity before disclosing visit details. Staff should confirm callers using a callback number already on file — not the number the caller provides. Patient information is shared with family members listed in the record, not with anyone claiming to be family.
Scenario 2: The Physician's Office Pretext
The setup: An attacker calls claiming to be from Dr. Smith's office (a real physician in your network). They say they need to verify that a specific patient is currently receiving home health services and who the assigned nurse is, as they are updating care coordination records.
Why it works: Scheduling staff routinely coordinate with physicians' offices. The request sounds routine. The caller knows the physician's name.
What the attacker does with it: Confirms active patients and their assigned nurses. Uses this to conduct Medicare billing fraud — submitting claims for services not rendered using the confirmed agency and nurse information.
The defense: Out-of-band verification. If a physician's office calls requesting patient information, call back the physician's office at a number your agency has independently verified — not the number provided by the caller.