Don’t Take the Bait: A Phishing Game for Healthcare Staff

Twelve messages fly out of the practice inbox one at a time, in random order. Seven are phishing and five are real mail. Click or tap a phishing message to shoot it, and let the real ones fly past. On a keyboard, aim with the arrow keys and press Space to fire. You get three shots per message.

• Phish caught: plus 500 points, and the game shows the red flag that gave it away.
• Real message delivered: plus 200 points.
• Phish reaches the inbox: minus 200 points, and the game shows the red flag you missed.
• Real message shot: minus 300 points, because blocking good mail slows the office down too.

At the end you see your score and how many of the 12 you got right. Ten or more right reads “Inbox defended.” Fewer reads “Some bait got through.” A review list then shows every message and the right call for each.

Players identify seven phishing messages among twelve emails to train pattern recognition and reduce impulsive clicks. The game highlights telltale signs such as lookalike senders, urgent same-day deadlines, gift-card requests, and bank detail change prompts. This interactive preview supports the security awareness training (staff education to identify and avoid cyber threats) required by HIPAA’s Security Rule, 45 CFR 164.308(a)(5).

Lookalike sender addresses give phish away, like a 1 in place of an l.

The seven phishing messages and their red flags

• “Your password expires TODAY” from PracticeMail Support, it@practicemai1-help.co. Lookalike sender domain (a 1 for an l) and a same-day deadline.
• “Quick favor: need 5 gift cards” from Dr. Patel, drpatel.office.private@gmail.com. Gift card request from a personal address claiming to be the boss.
• “INVOICE OVERDUE: open attachment” from Accounts, billing@pay-portal-secure.net. Unexpected invoice, outside domain, pressure to open an attachment.
• “Confirm direct deposit by 5pm” from Payroll Team, payroll@payrol-update.com. Asks for bank details with a deadline, from a misspelled domain.
• “Document waiting: sign in to view” from e-Signature, notify@docs-share.biz. A “sign in to view” link is how passwords get harvested.
• “Package held: pay $1.99 fee” from Parcel Desk, track@parcel-hold.info. A tiny fee is bait to steal your card number.
• “New benefits form (benefits.zip)” from HR, hr@yourpractice-benefits.com. Outside domain dressed up as your own HR, with a zipped file.

The five real messages, and why they are safe

• “Staff meeting moved to 2pm” from Office Manager (your domain). Internal, expected, asks for nothing.
• “Results you ordered are in your portal” from Reference Lab (known sender). Expected, and it sends you to the portal you already use.
• “Scheduled maintenance Saturday 10pm” from Your EHR vendor (known sender). An announcement; no link to sign in, nothing to pay.
• “Re: Thursday appointment” from Mrs. Alvarez (patient, replying). A reply in a thread you started.
• “Lunch order before 11?” from Coworker (your domain). Low stakes and expected.

Sources: 45 CFR 164.308(a)(5), security awareness and training (eCFR); The HIPAA Security Rule (HHS Office for Civil Rights)

This game records nothing, so on its own it does not document anyone’s training. Use it as a warm-up or a refresher, and record training where it is saved. In the One Guy Consulting portal, the Cybersecurity Awareness course records each person’s completion, and a separate Phishing, Smishing, and Vishing training runs interactive drills on scam emails, texts and phone calls.

Learning objectives

• Check the sender’s real address, not just the display name, before acting on a message.
• Treat deadlines, gift card requests, bank detail changes and “sign in to view” links as reasons to slow down.
• Recognize expected, low-risk mail so real work keeps moving.
• Know who to report a suspicious message to.

Instructor notes and facilitator script

1. Play the game once to review all twelve message types before running the exercise with staff.
2. Put it on a shared screen at a staff meeting. For each message, ask the room: “Shoot it or let it through?”
3. When a phish is caught or missed, read its red flag out loud and ask whether anyone has seen one like it at your practice.
4. At the end, walk the review list. Ask: “Who receives reports of suspicious email here?” and “How would you check a gift card request from a doctor?”
5. Close with one rule: verify unusual requests through a channel you look up yourself, never through the message.

Team rollout steps (roles and timing)

1. Security official: share this page with staff and name the person who receives reports of suspicious messages.
2. Office manager: schedule a short group session using the script above.
3. Each staff member: play on their own before or after the session.
4. Privacy officer: assign the recorded training in the portal so completion is documented.

Scoring, metrics and reporting

The score and the “of 12 right” count appear only on the player’s screen. If you want a team snapshot, ask people to share their count, and use it to pick topics to review, never to single anyone out. Completion records for your HIPAA documentation come from the portal’s courses, not from this game.

Follow-up tasks

• Tell staff in writing that no one from IT will ever ask for their password.
• Post the name of the person who receives suspicious-message reports.
• Send periodic security reminders; HIPAA lists “periodic security updates” as an addressable part of awareness training (45 CFR 164.308(a)(5)(ii)(A)).

Anonymized outcome: after direct outreach to offices that had stalled, a health group with more than 100 offices lifted take-up of its compliance program by about 17%, and more staff finished their required HIPAA training.

Chuck Weiselberg, Founder, One Guy Consulting; Certified HIPAA Professional (CHP) with 10 years' HIPAA compliance experience. Full bio.

Is the game recorded?

Nothing you play here is recorded.

Is signup required to play?

No, the game is free to play and requires no signup.

Is this official HIPAA training?

This is a preview interactive for staff awareness; security awareness training is a HIPAA standard (45 CFR 164.308(a)(5)).

Monsters Ate My BAADecide which vendors need a business associate agreement.

See Full-Scope staff training and pricing on One Guy Consulting’s Products page.