An unexpected invoice, a document-sharing request, or a message that appears to come from a software vendor can interrupt a busy optometry team. Phishing tries to turn that interruption into a click, a payment, or the disclosure of information.
Look at the request, not just the spelling
A polished message can still be fraudulent. Pause when a request creates urgency, changes payment details, asks for a password, or sends you to an unfamiliar sign-in page. A familiar display name, logo, or professional tone is not proof of identity.
Verify through a separate, known channel
If a request is unusual, contact the person or company using details already known to your practice. Avoid relying on the phone number or link supplied in the suspicious message. For an invoice change, follow your practice’s established approval process before taking action.
Make reporting simple and blame-free
Tell staff how to report a suspicious message to the appropriate manager or IT provider. Encourage early reporting even if someone has already clicked. Give your team clear instructions for preserving the message safely rather than forwarding it widely or experimenting with its links.
Support people with appropriate safeguards
Discuss email filtering, account protection, and MFA with your provider. Technical controls and staff awareness should support each other. Training should use realistic examples and explain the next action, not simply ask staff to be more careful.
Turn one example into a team habit
At a short staff meeting, walk through a harmless sample request. Ask what needs verification, who would approve it, and where it should be reported. Adjust the instructions if the team gives different answers.
ClearPHI focuses on practical IT and cybersecurity support for optometry practices in Broward County and nearby communities. Contact Trent Tolan to register interest in a free 20-minute remote discovery call; client services are planned to begin December 1, 2026.
Reference: NIST: Phishing guidance for small businesses.
This article provides general educational information. It is not legal, medical, or individualized compliance advice. Security measures reduce risk but cannot eliminate it; changes to clinical systems should be coordinated with your IT and software providers.