How do I secure my patient portal account after a healthcare data breach? Start at the provider’s official website or app, change the portal password if it may have been exposed, and enable multifactor authentication (MFA) if available. A breach notice does not necessarily mean portal login details were stolen: confirm what information was involved with the provider using a phone number you already trust, then watch for unfamiliar medical bills and insurance claims.
Secure the portal account first
- Open the portal safely. Use a saved bookmark, a web address you already know is genuine, or the provider’s official app. Do not use sign-in links or phone numbers found only in an unexpected email, text, or call. If you cannot log in or see account changes you did not make, call the provider using the number on your insurance card or a previously verified website. The FTC explains how to recognize and avoid phishing at How To Recognize and Avoid Phishing Scams.
- Change a potentially exposed password. If the notice says your password or portal credentials were exposed—or the provider confirms they may have been—reset the password through the official login or recovery page. The FTC advises: “If a company or website tells you it lost your password in a data breach, change your password right away.” Choose a distinct password you do not use elsewhere; a password manager can help create and keep track of unique passwords. If you reused or closely adapted that password on other services, change it on those accounts too. The FTC’s account advice is at Creating Strong Passwords and Other Ways To Protect Your Accounts.
- Turn on MFA if the portal offers it. Look in account security or sign-in settings. An authenticator app or security key is preferable to text or email codes when the portal supports those choices, according to FTC guidance. Options vary by provider, so use the strongest available method you can reliably recover if you lose access to your device.
The FTC’s October 2024 advice for compromised accounts says to “Aim for 12 to 15 characters” or use a passphrase. That is consumer guidance, not a universal portal rule; follow any specific requirements the portal displays. See Email or social media hacked? Here’s what to do.
As an Amazon Associate I earn from qualifying purchases.
Should you buy a security key?
A security key is a physical second factor, and the FTC describes security keys as the strongest two-factor method among the options it discusses. But that does not mean every portal supports FIDO2 or WebAuthn keys. Ask the provider or check the portal’s MFA settings before buying one. The FTC’s overview is How To Protect Your Accounts and Devices From Hackers.
Verify what the breach notice means
Contact the provider through a verified number or portal channel and ask what kinds of information were involved, including whether portal credentials, insurance identifiers, or other personal or health information were exposed. Ask whether it recommends account recovery or other protective steps. Do not give medical or account information to an unsolicited caller, texter, or email sender simply because they refer to a breach.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
A notice about a healthcare breach does not by itself establish that someone accessed your portal account. Under HHS’s HIPAA Breach Notification Rule, covered entities and business associates have duties concerning breaches of unsecured protected health information, subject to exceptions and risk-assessment considerations. The FTC has separate rules for certain personal health record vendors. The applicable rules and notice do not reveal which information in a particular incident was exposed or what portal controls are available. HHS explains the rule at Breach Notification Rule.
Watch for medical identity theft
Review bills and explanations of benefits (EOBs) from your insurer for care, prescriptions, or other services you do not recognize. Also look out for collection notices about unfamiliar medical debt or a notice that you have reached a benefit limit. These can be signs that someone used personal information to obtain care, prescriptions, or devices, or to submit insurance claims.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
If you see an unfamiliar charge or claim, contact both the provider named on the bill or EOB and your insurer using verified contact details. Ask them to investigate and explain how to dispute the entry. Keep copies of notices and correspondence, and request relevant records from the providers, pharmacies, laboratories, or insurers where the suspected misuse may have occurred.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →The FTC defines medical identity theft as the misuse of personal information—such as a name, Social Security number, health insurance account number, or Medicare number—to obtain medical goods or services or submit claims. Another person’s health information may become mixed into your records, which can affect your care or benefits. The FTC’s guidance, including signs to watch for and record-request advice, is at Medical Identity Theft: FAQs.
Quick Recap
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
What to do if someone used your medical information
- Request the records connected to the suspected misuse. Ask relevant providers, pharmacies, laboratories, and insurers for records that can help identify the care or claims. If a provider refuses access because the records contain another person’s information, contact the privacy contact named in its privacy notice, a patient representative, or an ombudsman to ask about appeal options.
- Ask the provider to correct or flag inaccurate information. Explain which entries you believe are not yours and ask what process it uses to investigate and address them. Keep a record of whom you contacted and when.
- Use the FTC’s consumer recovery resource. For misuse of personal information for medical care or insurance benefits, go to IdentityTheft.gov to build a recovery plan tailored to your situation. The FTC’s health-breach reporting rules are for certain organizations; filing an organizational breach report is not a substitute for a consumer’s identity-theft recovery steps.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
