A leading software platform that allows patients nationwide to access their electronic medical information is warning users that scammers may be trying to steal their information.

The scam is targeting users of Epic software, which powers the MyChart portal at UC Davis Health and many other health systems. Scammers have been using fake websites and login pages this summer that are designed to look like they are coming from MyChart.

“We’ve seen an uptick in scammers trying to trick patients by using the MyChart name or logo to make emails, text messages, phone calls, and websites look official,” stated Trevor Berceau, director of research and development for Epic Systems Corp., in a July 26  blog post.

“Some might try to steal your login information or promise free gifts if you enter payment details,” Berceau said.

How to spot a suspicious MyChart message

Be cautious of messages that:

• Create urgency or threaten account suspension.
• Ask for passwords, verification codes, personal, or payment information.
• Request that you click a link to verify or update your account.
• Contain spelling, grammar, or formatting issues.
• Come from an unfamiliar or suspicious sender.
• Include unexpected attachments.
• Offer refunds, prizes, or other unexpected benefits.
• Simply do not seem legitimate, even if they use MyChart branding.

How to tell if a MyChart email, text or phone call is a scam

One scam circulating by email offers MyChart users a “unique opportunity to receive a completely new Medicare Kit!”

To claim the “first-aid and medical-grade preparation kit,” users are asked to click on a link that purportedly leads to a survey. Then they are asked to provide their financial information to pay for the cost of shipping.

But neither UC Davis Health nor MyChart use the portal to give away prizes, and neither would ask for credit card or banking details.

How to spot fake MyChart login pages

The scam emails may appear to be real — the “from” line may state “MyChartTeams” and the sender’s address could include the word MyChart in some variation. But the “from” address is fake (real MyChart emails come from UC Davis Health or MyChart Central). The body of the message, which could be an image with realistic-looking logos, is a replica intended to get unsuspecting users to click on it.

Those who click on the log-in screen will see a series of pop-up screens stating something about the patient’s lab results and encouraging them to click on buttons to access the results. (In reality, lab results are available directly in MyChart, never in a program that needs to be downloaded).

But users who click the buttons are actually installing malware on their computer.

Is MyChart itself compromised?

Epic says the scams are an attempt to trick users into responding to fraudulent messages and MyChart itself has not been compromised.

“Scammers are taking advantage of the popularity of the MyChart brand rather than any security concern,” Berceau stated, “so you can continue to use MyChart as normal.”

The website MyChart.org contains a Staying Safe page with additional tips to protect users from scams and fraud.