How to Spot and Avoid Dangerous MyChart Email Scams
Warning: Scammers Are Impersonating MyChart — Here's How to Protect Yourself
Washington D.C., September 2026 — A growing wave of sophisticated online scams is targeting patients who use MyChart, the widely popular health records platform powered by Epic Systems, and NBC Washington's "Working 4 You" consumer protection segment is sounding the alarm with a detailed breakdown of how these scams work and what people can do to protect themselves.
One of the most prevalent scams currently circulating involves a fraudulent email that informs recipients they have been selected to receive a free "Medicare Kit." The message mimics the look and branding of legitimate MyChart and Epic communications, complete with official-looking logos, professional formatting, and congratulatory language designed to make the recipient believe they have genuinely qualified for a valuable healthcare benefit.
The scam email typically instructs the victim to click a link or provide personal information to claim their free kit — actions that can lead to identity theft, unauthorized access to medical records, financial fraud, or the installation of malware on the victim's device. The sophistication of these fraudulent communications makes them particularly dangerous, as even tech-savvy individuals can be deceived by how convincingly they replicate legitimate healthcare correspondence.
MyChart, used by tens of millions of patients across the United States to access medical records, schedule appointments, communicate with healthcare providers, and manage prescriptions, is an attractive target for scammers precisely because of its widespread use and the sensitive nature of the information it contains.
Cybersecurity experts and healthcare advocates advise patients to never click links in unsolicited emails claiming to be from MyChart or Epic, to always navigate directly to MyChart through their healthcare provider's official website, and to report suspicious emails to both their healthcare provider and the Federal Trade Commission.
Additional red flags include emails that create a sense of urgency, promise unexpected free gifts or benefits, request Social Security numbers or financial information, or come from email addresses that don't match official institutional domains.
When it comes to your health data, skepticism is your strongest defense.