While phishing attacks might begin with an email, they extend far beyond the initial vector. Once a user has entered credentials, approved an authorization request, opened an attachment, or responded with protected information, deleting the email doesn’t correct those actions. Healthcare providers do, however, have the option of contacting users from a non-affected HIPAA compliant email address to alert employees and collect reports from users who received and responded to the message.

 

Removing the message controls only one stage

A single click doesn’t mean that everyone who opened the message is compromised. Asymmetric response rates can reveal that at least one person clicked through defenses and that you need to track email interactions. Analysts from a study published in JAMA Network examined 422,062 clicks from almost three million deliveries to six U.S. healthcare organizations during a simulated attack campaign. It sets a click rate of 14.2%, finding that “among U.S. health care institutions that performed phishing simulations, nearly 1 in 7 simulated emails sent were clicked on by employees.”

Separately, Paubox found that users report only 5% of the phishing attacks they know about. Until people understand the potential risk they face, deletion not only hides those phishing links from IT but leaves the malicious link sitting there waiting for someone else to click. Facts that like these make it useful to have users detail their interaction by sending a HIPAA compliant email containing checkboxes about links, attachments, credential prompts, authorization requests, and other data sharing so recipients can confirm how they engaged with the content.

 

What can remain after the message is gone

Stolen credentials and active sessions

Fraudulent login screens can harvest more than usernames and passwords. As stated in a Paubox article discussing device-code phishing, “Most phishing attacks steal a password. Device code phishing skips the password altogether and steals something more durable: an authenticated session token.” Token reuse was also witnessed in another attack where compromised credentials were used to authenticate to Outlook and other Microsoft 365 services without entering either the password or multi-factor authentication (MFA) challenge a second time.

Password resets can be required, but session tokens may maintain access. Remediation efforts should try to contain breached identities by forcing password resets as well as terminating active sessions and device codes where possible.

 

Persistent application permissions

“The user is duped into installing malware on their device,” reads another Paubox article discussing prevalent email threats. “OAuth consent phishing asks the victim to authorize a malicious third-party application rather than surrender a password.”

OAuth 2.0 is an authorization framework that determines how one app requests access to another app regarding a user's account. Application permissions to read email will persist until explicitly removed, even when passwords are updated. Patients will be alerted to infiltrated applications and can be instructed to revoke their own access, as scammers may already have total access to the account.

 

Hidden mailbox rules

Paubox reporting on BEC phishing kits adds, “An inbox rule can automatically move, hide, or delete specific incoming emails without the account owner noticing.” Compromised mailbox access was used to manipulate inbox rules and hide responses to phishing messages in a criminal fraud effort. Providers can review unauthorized access and have security teams send summaries of cleaned settings through unaffected HIPAA compliant email accounts. It allows clinical staff to quickly determine whether replies that should be visible are actually visible.

 

Messages sent from a trusted account

An attacker could reply to a conversation already in progress or use the captured account to forward a similar message to others. Paubox documented a 2026 campaign where phishing emails were forwarded to coworkers using stolen Outlook accounts.

The article observed how Microsoft Exchange accounts were used to launch attacks by replying to legitimate inbound email. Attackers use these conversations to spread fraud and extortion demands while the associated emails bypass filters that search inbound messages only.

 

Why post-removal investigation matters in healthcare

A healthcare mailbox may contain clinical, billing, referral, insurance, and scheduling correspondence. The Paubox mailbox-takeover report explains that attackers with valid credentials can read historical email for protected health information (PHI) and hide their activity with inbox rules. Security teams must determine what the account could access and what it actually accessed. HIPAA compliant email can help privacy and security teams exchange scoped patient lists, dates, document categories, and investigation updates within the authorized response group.

 

FAQs

Does clicking a phishing link always mean the user’s account was compromised?

No, but responders must determine whether the user entered credentials, approved an authentication request, downloaded a file, or exposed an active login session.

 

Is resetting the user’s password enough after a successful phishing attack?

No, because active sessions, malicious mailbox rules, application permissions, or unauthorized authentication methods may remain after the password changes.

 

Can phishing compromise an account protected by multi-factor authentication?

Yes, because some attacks steal an authenticated session token or trick the user into approving access after completing multi-factor authentication legitimately.

 

What is a stolen session token?

A stolen session token is copied login information that may allow an attacker to impersonate an authenticated user without entering the password or completing another MFA prompt.