October 2026 | Medical Practice Cybersecurity Salt Lake City | AI Threats | Halloween | HIPAA
Look at any Salt Lake City neighborhood this Halloween and you'll see countless monsters roaming the streets. Vampires, creatures and ghouls all "wreaking havoc" — which is to say, going to parties and trick-or-treating. A few of them will probably end up in your waiting room with candy-related complaints.
The real monsters don't look like this. They don't announce themselves as threats, even jokingly. They dress themselves in the costume of harmless, helpful allies — a referral from a specialist, a call from a familiar physician, a friendly AI assistant offering to summarize a chart.
While medical practices like yours explore AI tools to ease documentation and administrative burden, cybercriminals are using the same power to disguise old scams with new polish. The right IT support for medical practices and a few core security habits mean your staff don't have to be expert scam-spotters to keep patient records safe. Garlic around your neck won't help you here — it's all about simple processes and safeguards.
AI Shapeshifters: Sounding Right Isn't Enough Anymore
Video and audio used to be a clear differentiator between someone real and someone trying to scam you. Now, with AI, scammers can take many forms — realistic voice messages and calls designed to convince your staff a request is legitimate. Picture a voicemail that sounds exactly like a referring physician asking your front desk team to send patient records to a new fax number, or a call that sounds like your EHR vendor's support line asking for login credentials to "fix a sync issue."
Even if you can spot the telltale signs of AI-generated audio today, those wrinkles are getting ironed out quickly. You might not be as good at spotting them as you think — many "AI tells" are already outdated.
Instead of depending on individual detection, focus on what can't be faked: verification procedures for any sensitive action — releasing patient records, changing payment or remittance details, granting system access. Shapeshifters can fool your ears, but they can't fake a call-back to the referring office's known number or multi-factor authentication on your EHR.
AI Mummies: Old Scams Wrapped in New Cloth
In past years, phishing messages had spelling and grammatical mistakes that made them easy to spot. Typos, generic greetings and overused urgency became the benchmarks staff were taught to look for.
Those same scams have much better costumes now. Perfect spelling, flawless formatting and convincing letterhead give them a sense of authority — especially when they arrive dressed as the paperwork your practice processes all day: referral letters, insurance prior authorization requests, lab results notifications and records requests.
Like an ancient mummy rising from the tomb, these scams are just as dangerous as they've always been — but wrapped in fresh rags that disguise how monstrous they really are. Train your clinical staff and front desk team to look for red flags in the requests themselves, not just flaws in the messages. An unexpected "referral" with an attachment, an "insurance authorization" demanding a portal login, a records request from an unfamiliar address — judge them by what they ask for, and don't relax just because everything is spelled properly.
AI Vampires: Never Invite Them In
In vampire myths, innocents are protected by never inviting the vampire inside — the creature cannot enter without direct permission. Unvetted AI tools work the same way.
When staff use AI tools that haven't been approved by the practice — a phenomenon known as shadow IT — there are boundless opportunities to expose PHI to unvetted programs. And in healthcare, this isn't just risky. It can be a HIPAA violation.
An AI tool can't go into your EHR and read charts on its own. But it won't stop a well-meaning staff member from pasting a patient's visit notes into a free chatbot and asking for a summary, or dropping a spreadsheet of patient balances into an AI tool to "clean it up." The moment PHI leaves your systems for an unapproved tool, you've invited the vampire in. If a vendor won't sign a business associate agreement (BAA), and you can't answer where that information goes, where it's stored and what the tool's creator can do with it, it's not a tool that should be invited anywhere near patient records.
The Best Defense Against AI Monsters? Better Rules
Advancements in AI have made deception cheaper to exploit, faster to implement and more convincing — even to trained eyes. But if your team internalizes a few small protective habits, even the most sophisticated disguises won't trip them up:
- Verify sensitive requests through a second channel — call the referring office or vendor at a known number, always, no exceptions
- Judge messages by what they ask for, not how polished they look — even referrals and insurance authorizations
- Use only practice-approved AI tools covered by a BAA, and never paste patient information into unapproved ones
- Make reporting suspicious activity fast, easy and blame-free — hesitation is what turns incidents into breaches
Simple rules, consistently followed, beat sophisticated detection skills every time — and they're exactly the kind of administrative safeguards HIPAA expects your practice to have.
Frequently Asked Questions
What are AI-powered cyber threats to medical practices?
They're traditional attacks — phishing, impersonation, fraud — enhanced by AI: deepfake voice calls pretending to be physicians or vendors, flawlessly written scam emails disguised as referrals and insurance authorizations, and automated targeting of healthcare organizations, which remain the top ransomware target because patient records are so valuable.
Can staff use AI tools like chatbots with patient information?
Only if the tool has been vetted and approved by the practice and the vendor has signed a business associate agreement (BAA). Pasting PHI into an unapproved AI tool can constitute a HIPAA violation, even with good intentions. Every practice should have a clear approved-tools policy and train staff on it.
Do you offer HIPAA-compliant IT services for medical practices in Salt Lake City?
Yes. Qual IT provides HIPAA-compliant IT services and medical practice cybersecurity in Salt Lake City, including EHR and network security, email and phishing protection, encrypted PHI backup and disaster recovery, staff security awareness training, AI usage policies and incident response planning.
Know Where Your Gaps Are Before the Monsters Find Them
Need help protecting your practice against AI monsters coming for your patient records? We'll discuss how your staff are using AI, how sensitive requests like records releases and payment changes are verified, and what protections you already have around your EHR and PHI backups. You'll leave knowing where your biggest gaps are and which threats are seriously spooky this Halloween season.
We work with Salt Lake City medical practices to protect patient data and maintain HIPAA compliance.
Schedule a free 10-minute discovery call with Qual IT. Book your discovery call here.
