According to Paubox’s 2026 Healthcare Email Security Report, healthcare organizations reported 170 email-related incidents to the HHS Office for Civil Rights in 2025. That total is down from the year before, but Paubox found that most incidents still involved phishing, credential compromise, spoofing, or improper handling of sensitive information by email. Paubox also found that the organizations still getting breached were the ones with the weakest email configurations. Meanwhile, KnowBe4’s “2025 Phishing By Industry Benchmarking Report,” as cited by Paubox, found that phishing emails increased by 17% and that attacks evading native defenses rose 47%.

Real-world evidence shows how this works. In “Phishing simulation exercise in a large hospital: A case study,” researchers describe a yearlong simulation at an Italian hospital with more than 6,000 employees. The hospital ran the exercise after staff reported fear of phishing but little confidence in spotting it, and after a real attempt to defraud it by impersonating the hospital’s Director. The case study also found that over a third of medical staff had not completed a recently required online training module on time, this shows that training alone doesn’t reach everyone.

 

What HIPAA requires

HIPAA does not explicitly require phishing simulations. It does require a training program. Under the Security Rule, covered entities and business associates must “implement a security awareness and training program for all members of its workforce (including management).”

The same section lists implementation specifications that target phishing. These are “addressable,” meaning you must implement them or document why an alternative is reasonable. They include “periodic security updates” (§ 164.308(a)(5)(ii)(A)) and “procedures for guarding against, detecting, and reporting malicious software” (§ 164.308(a)(5)(ii)(B)).

The Privacy Rule adds a separate obligation, a covered entity “must train all members of its workforce on the policies and procedures with respect to protected health information” as necessary and appropriate for their roles. Simulations are a reasonable way to meet the obligations of this regulation.

 

1. Onboarding

New hires are among the most vulnerable users. In the case study the authors acknowledge that they did not account for staff hired after the first campaign began, which left a gap in their coverage.

Organizations should cover phishing basics in initial security training, then include new hires in simulations. When people learn in their first month that simulations are routine, they are less likely to feel singled out later. The case study’s authors note that when staff are unaware of simulations, they can feel surveilled, which can turn the security team into an adversary instead of a source of help. They recommend training staff on why simulations happen and what they do and don’t monitor.

 

2. Consistency over intensity

For the general workforce, regularity matters more than how clever the simulations are. It keeps awareness fresh, builds the habit of pausing before clicking, and produces enough data points to show real trends. It also fits the Security Rule’s requirement for “periodic security updates” better than a once-a-year approach. It matches federal guidance as well, according to “Understanding the Efficacy of Phishing Training in Practice,” HHS recommends that medium and large US healthcare organizations pair annual awareness training with monthly simulated phishing and social engineering campaigns.

In the case study, click rates fell across campaigns, the tailored lure dropped from 55% of recipients in the first campaign to 21% in the second, and the generic lure from 7% to 3% by the third. The authors also cite earlier hospital research suggesting that time and repeated exposure, rather than mandatory training alone, were what reduced clicking.

 

3. After a failure

  • Immediate feedback. Show what they missed, such as the mismatched sender, the urgency cue, or the odd link. The hospital in the case study sent anyone who clicked to a page explaining the exercise and listing eight ways to avoid being caught in future, including checking the real domain, hovering over links, and never entering a password after following an email link.
  • Short, targeted training. A brief refresher on the specific tactic works better than a long generic course. In “Understanding the Efficacy of Phishing Training in Practice,” between 37% and 51% of embedded training sessions ended with no time spent on the page, and users completed only about 24% of sessions. Interactive training, when completed, was associated with a 19% lower chance of failing a later simulation, while static pages showed no such benefit.
  • Extra attention for repeat patterns. If the same person fails several tests in a row, treat it as a signal for a supportive conversation about workflow, workload, or the messages they handle. In Evaluation of a mandatory phishing training program for high-risk employees at a US healthcare system, a hospital required an online course of employees who had clicked on five or more simulations, and it did not meaningfully lower their click rates, which supports a conversation about workflow over another round of formal training.

 

Tailor simulations by role and risk

The case study’s authors suggest that, instead of having one simulation campaign at the entire organization, hospitals could send small numbers of specific simulations to sensitive departments. This matters because attacks like spear phishing and whaling are targeted by definition, and the hospital’s own incident involved a fake request, supposedly from the Director, aimed at the Head of Purchasing. Staff who had already completed required training may also respond differently to a training-simulation than those who hadn’t.

This approach also mirrors the Security Rule’s risk analysis requirement, which calls for an “accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information”.

 

Get the right people involved

One of the case study’s lessons is that a simulation is an organizational project, not just an IT task. Its authors recommend involving the board or general director, IT and security leadership, the help desk, HR and legal, the data protection office, and staff representatives such as unions before a campaign launches. A few points follow:

  • Brief the help desk. Expect extra calls and reports during a campaign. An overwhelmed help desk can undermine the exercise.
  • Protect privacy. In the case study, an external consultancy handled the data and gave the hospital only summary results, so individuals could not be identified or blamed.
  • Pilot your messages. The authors note that a small pilot group could have caught the bonus problem without tipping off the whole workforce.
  • Don’t change your real defenses for the test. Letting simulated emails bypass your spam filters can leave the organization exposed. Simulate under real conditions.
  • Share the results. Summarize outcomes for staff and management so everyone understands the current risk and what happens next.

Paubox Security Awareness Training, an add-on to Paubox Email Suite, lets you send one-off campaigns or automate them monthly. It includes six built-in phishing scenarios, optional AI-generated variations (all human-approved before sending), and per-employee Low, Medium, or High risk scoring so you can see who needs more training. Campaign history and six-year audit logs support your documentation, and it runs from the dashboard you already use for email security.

Learn more: Security awareness training

 

FAQs

What is a phishing simulation?

A phishing simulation is a controlled, fake phishing email sent to employees to see how they respond and to give them safe practice at spotting real attacks.

 

What is the difference between phishing, spear phishing, and whaling?

Phishing targets many people with generic messages, spear phishing targets a specific person or group with a tailored message, and whaling is spear phishing aimed at senior executives.

 

Can phishing also happen outside of email?

Yes, attackers also use text messages (smishing), phone calls (vishing), and messaging apps, so awareness training should cover those channels too