Suspicious activity in the scheduling mailbox
A fictional tabletop exercise for your practice team.
It’s a busy morning at a fictional small medical practice. The front desk depends on a shared inbox for appointment messages. A staff member reports an unexpected sign-in approval prompt. Soon after, a patient calls about an unusual email that appears to come from the practice.
Take the report
The front desk records the time, the mailbox involved, and what the staff member and caller observed. Staff can tell the caller to avoid the link and use the practice’s known phone number for appointment questions. The office lead calls the designated IT contact using the contact list kept outside the mailbox.
Discuss together. Who takes that call if the office lead is away? Where can staff record the report without copying patient details into a general support ticket?
Decide whether to restrict access
In the exercise, the authorized administrator finds a forwarding rule that staff don’t recognize. Ask the administrator how they would preserve available sign-in records, mailbox logs, and rule details while deciding whether to revoke active sessions or temporarily restrict access. Record who can approve those actions and when they were taken.
Discuss together. If the inbox is unavailable, who moves appointment inquiries to the practice’s established phone workflow, and how does the front desk track pending callbacks?
Agree on when to resume normal use
The office lead and IT contact agree on what they would check before the front desk resumes using the inbox. The administrator can review forwarding rules and delegated access, confirm staff can sign in as expected, and test internal and external mail delivery. The practice lead assigns someone to reconcile the messages and callbacks that accumulated during the interruption.
Discuss together. Who reviews what is known about the affected messages and accounts? What questions remain open, and who owns the next decision?
Record what the exercise exposed
Before ending the discussion, document who can approve mailbox changes and who can fill in for them. Record where staff can find the incident contacts and how the front desk will handle appointment messages during an outage. Assign an owner and a due date to any gaps the exercise surfaced.
For more on deciding who reviews security alerts and who can take action, explore managed security.