Now more than ever, it’s increasingly difficult to spot fake or misspelled email addresses created to trick people into thinking they’re receiving messages from familiar companies, partners and vendors. To better protect our patients and staff against these threats, all emails received from senders outside the Partners network are now tagged with a red text box that says, “External Email – Use Caution.”

Launched in April, this tagging system is part of an ongoing Partners Information Security effort to reduce the likelihood of phishing – the most common and highly successful technique used to breach organizations, as well as individuals, around the world.

“Phishing is a real danger that affects all organizations, including large health care organizations, which is why it’s so important for Brigham Health employees to understand the ‘why’ behind the new red header,” said Adam Landman, MD, MS, MIS, MHS, chief information officer. “In addition to the widespread costs and scope, phishing attacks can expose private patient, employee and research data, as well as compromise technical and clinical systems, which may, in turn, cause life-threatening delays in treatment and care.”

According to the 2016 Ponemon Institute benchmark survey results, the average cost of a data breach for health care organizations  was estimated a more than $2 million. The institute also reported nearly 90 percent of health care organizations surveyed had a data breach between 2014 and 2016.

To combat this, the Partners Information Security team has employed multiple technologies, developed user awareness trainings and followed industry best practices. However, even with these measures, phishing messages continue to be a risk. Clearly identifying emails that are sent from outside the organization is a common practice in other organizations and was the next logical step to increasing user awareness of these potentially harmful messages at Partners HealthCare.

It’s important to note that an email message with this red label does not necessarily mean the email is malicious – only that the recipient should take caution before clicking any links or attachments included within the email. Some emails that are tagged with the red label may be from individuals you communicate with regularly for work-related purposes.
The IS team is closely monitoring the effectiveness of these tags and exploring alternate ways to clearly identify external emails to continually improve our ability to maintain a secure electronic environment.

If you think you have received a phishing email, do not open the message, click on any links or download its attachments. Highlight the email and click the “Report Phishing” button in your Outlook menu or “Forward as Attachment” – which can be found by clicking the “More” button next to the “Forward” button, and selecting “Forward as Attachment” – to nospam@partners.org. If you are unable to locate the “Report Phishing” button in Outlook, follow these directions.

For questions or additional information, email CISPO@partners.org, visit pulse.partners.org/ispo and read the tips below.