iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
To secure a patient portal account after a healthcare data breach, go to the provider’s official website or app, change the portal password if it may have been exposed, and turn on multifactor authentication (MFA) if offered. Do not assume the breach included your portal login: ask the provider through a contact method you already trust what information was involved. Then watch bills and insurance explanations of benefits for care or prescriptions you do not recognize.
How do I secure my patient portal account after a healthcare data breach?
Work through these steps using the provider’s official site or app—not a link in an unexpected email or text. If you cannot sign in or notice changed account details, call the provider using a number on your insurance or medical card, or one from a website you previously verified. The FTC advises consumers not to use contact details supplied only in an unexpected message when checking a possible scam: how to avoid a scam.
- Confirm what happened. Contact the provider using a trusted number and ask what information was involved, whether portal credentials or insurance identifiers were exposed, and whether it recommends account recovery or other protective steps. A breach notice alone does not establish that someone accessed your portal login.
- Change an exposed or potentially exposed password. Use the portal’s official sign-in or recovery flow. Make the new password distinct from passwords used elsewhere. If you reused or used a similar password on other accounts, change it on those services too. The FTC says to change a password right away when a company or website reports that it lost the password in a breach: Creating Strong Passwords and Other Ways To Protect Your Accounts.
- Enable MFA if the portal supports it. Look in account security settings. When the provider offers a choice, the FTC recommends an authenticator app or security key over codes sent by text or email. Confirm the portal supports a particular security key before purchasing one.
- Check your account and contact details. Review the profile, recovery email address, phone number, and recent account activity if the portal displays it. If anything is unfamiliar, contact the provider through a verified number and ask it to help secure or recover the account.
- Monitor medical and insurance records. Review bills and explanations of benefits (EOBs) for services or prescriptions you did not receive. Contact the provider and insurer about suspicious entries, and request records if needed.
Choose a strong, unique password
A password exposed in one breach can put other accounts at risk if you reused it. Replace it wherever it was reused or closely repeated, not just on the portal. A password manager can help generate and keep track of unique passwords. In its October 2024 hacked-account guidance, the FTC says to “Aim for 12 to 15 characters” or use a passphrase; this is consumer guidance, not a universal patient-portal requirement: Email or social media hacked? Here’s what to do.
Which multifactor authentication option should I use?
MFA adds a second check beyond your password. The best available choice depends on what the provider supports and how you can recover access if you lose the device or key.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
| Method | Security guidance | What to check |
|---|---|---|
| Security key | The FTC describes a physical security key as the strongest two-factor method among the options it discusses. | Availability and compatibility are portal-specific. Confirm the portal supports the key or standard before buying one. |
| Authenticator app | The FTC prefers an authenticator app to codes sent by text or email when available. | Check the provider’s setup and account-recovery instructions, including what happens if you lose access to the phone. |
| Text or email code | Less preferred than an authenticator app or security key when those alternatives are offered. | Use it if it is the portal’s available MFA option, and keep your phone number or email address current. |
A FIDO2 security key works only when the particular portal supports a compatible sign-in method. The FTC’s general recommendation of security keys does not mean every provider accepts them. Its consumer guidance on two-factor authentication explains the options: Use Two-Factor Authentication To Protect Your Accounts.
How can I tell if someone used my health insurance?
Look for records that do not match care you received. The FTC identifies these warning signs of possible medical identity theft:
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
- A bill or EOB for a visit, treatment, prescription, or medical device you did not receive.
- Collection contact about unfamiliar medical debt, or unfamiliar medical debt on a credit report.
- A notice that you have reached a benefit limit when you believe you have not.
Medical identity theft occurs when someone uses personal information—such as your name, Social Security number, health insurance account number, or Medicare number—to obtain care, prescriptions, or devices, or to submit insurance claims. It can also cause another person’s health information to be mixed into your records, which may affect your care or benefits. The FTC’s guide explains the warning signs and steps to take: Medical Identity Theft: FAQs.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What should I do if my medical information was exposed or misused?
If you see a service, prescription, claim, or debt you do not recognize, contact the insurer and the provider associated with the entry. Explain why you believe it is incorrect and ask them to investigate. Request relevant records from providers, pharmacies, laboratories, and insurers where you suspect misuse occurred.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
If a provider refuses to give you records because they contain another person’s information, contact the privacy contact listed in the provider’s privacy notice, a patient representative, or an ombudsman to ask about appeal options. The FTC’s medical identity theft guidance describes these record-request steps.
If someone used your personal information to obtain medical care or insurance benefits, use IdentityTheft.gov to create a recovery plan tailored to your situation. It is the FTC’s consumer recovery resource for identity theft. The FTC’s separate health-breach reporting rules concern certain organizations; filing an organizational breach report is not a substitute for your personal recovery steps: Complying with the FTC’s Health Breach Notification Rule.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
What a breach notice does—and does not—tell you
In the United States, HIPAA’s Breach Notification Rule applies to covered entities and business associates after breaches of unsecured protected health information, subject to exceptions and risk-assessment considerations. HHS defines a breach generally as an impermissible use or disclosure under the Privacy Rule that compromises the security or privacy of protected health information: HHS Breach Notification Rule.
Notification rules do not identify what happened to a particular person’s portal account. A notice may concern different types of information; only the provider’s incident-specific notice or a response from the provider can clarify whether portal credentials, insurance identifiers, or other data were involved. FTC rules separately apply to certain personal health record vendors. Use the contact information you independently verify to ask questions about your case.
Quick Recap
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
