Forty-one health systems, from Penn Medicine and Cleveland Clinic to Mount Sinai and MD Anderson, had warned patients by Aug. 27 about fake texts and emails offering a “MyChart Medicare Kit,” according to a Becker’s Hospital Review tally. The messages impersonate MyChart, the patient portal built by Epic, and dangle a free senior wellness package to get a click or personal details. The Medicare open-enrollment window, which runs through Dec. 7, is also a season when older patients report heavy unwanted phone contact.
A Scripps News consumer report published Aug. 31 on seniors “inundated with Medicare calls ahead of open enrollment” is built around the quote “They call 15 times a day.” Anyone on Medicare, or turning 65 this year, who gets a MyChart kit message or a stream of plan-sales calls now has a simple rule to apply: do not tap the link, and open MyChart directly or call the number on the plan card instead.
Stay ahead of scam news: Miss an enrollment or claim deadline and the money can be gone. Join the Retirement Money Brief and we’ll send you our Scam & Identity-Theft Action Card as a welcome gift.
Get the Brief + the scam action card →
We may earn a commission from links on this page.
Which 41 health systems have issued the MyChart warning?
The count comes from a running list kept by Becker’s Hospital Review, whose Aug. 27 update carries “41” in its headline and names each system. The tally counts systems that publicly told patients about the scam, so it is a floor rather than a census; any system that warned later or only by direct message is not in it. The 41 named are:
- Virtua Health (Marlton, N.J.); Penn Medicine (Philadelphia); St. Joseph Hospital (Nashua, N.H.); Lee Health (Fort Myers, Fla.); Hawaii Pacific Health (Honolulu)
- Curry Health Network (Gold Beach, Ore.); PeaceHealth (Vancouver, Wash.); Naples Comprehensive Health (Naples, Fla.); GBMC HealthCare (Baltimore); Ocean Beach Health (Ilwaco, Wash.)
- Texas Health Resources (Arlington); SGMC Health (Valdosta, Ga.); Riverwood Healthcare Center (Aitkin, Minn.); Avera Health (Sioux Falls, S.D.); Beebe Healthcare (Lewes, Del.)
- Premier Health (Dayton, Ohio); Van Buren County Hospital (Keosauqua, Iowa); ECU Health (Greenville, N.C.); University Health (San Antonio); Sentara Health (Norfolk, Va.)
- UMass Memorial Health (Worcester, Mass.); Methodist Health System (Dallas); Southeast Health (Dothan, Ala.); Cass Health (Atlantic, Iowa); MetroHealth (Cleveland)
- Tampa General Hospital (Tampa, Fla.); UAMS Health (Little Rock, Ark.); Mosaic Life Care (St. Joseph, Mo.); Cleveland Clinic; Hoag Health System (Newport Beach, Calif.)
- Tallahassee Memorial HealthCare (Tallahassee, Fla.); University of Rochester Medicine; Northwell Health (New Hyde Park, N.Y.); Boston Medical Center; Mass General Brigham (Somerville, Mass.)
- MD Anderson Cancer Center (Houston); Emory Healthcare (Atlanta); Cone Health (Greensboro, N.C.); Bon Secours Richmond Health System (Richmond, Va.); Memorial Healthcare System (Hollywood, Fla.); Mount Sinai Health System (New York City)
That is 41 systems from New Jersey to Hawaii, which is why the warning is described here as “more than 40.” Patients of a system not on the list can still receive the message, because the senders are not targeting any one hospital.
What the fake MyChart Medicare Kit message says
The texts and emails use subject lines such as “Your MyChart Medicare Kit Awaits!” and promise a free “Senior Health Package,” Becker’s reported. They do not come from the health systems or from Epic. Trevor Berceau, Epic’s director of research and development, said the rise in attempts “is due to scammers taking advantage of the popularity of the MyChart brand rather than any security concern.”
Epic told patients they “can continue to use MyChart as normal.” The guidance repeated by the health systems is to delete the message without clicking, check the sender address, watch for grammatical errors and treat any unsolicited free offer with suspicion. A real MyChart notice can always be confirmed by opening the portal or app directly, not through a link in a message.
Is anyone really getting 15 Medicare calls a day?
The 15-a-day figure is a quotation, not a measured average. The Scripps News report, by John Matarese and Emily Hanford-Ostmann, uses “They call 15 times a day” as its title line. Inside the story, Delores Reed, a recently retired Medicare beneficiary, says she gets Medicare-related calls several times a day even though she is on the Do Not Call registry, and adds, “I personally think they are a scam.”
Amy Nofziger, senior director of victim support at the AARP Fraud Watch Network, told Scripps: “Medicare knows your Medicare number.” Her point is that a caller who asks someone to confirm that number is not Medicare. The same report ties the call flood to the MyChart messages, citing Becker’s for the claim that more than 40 health systems had warned patients.
Why Dec. 7 is when the pressure peaks
Medicare’s annual open-enrollment period runs October 15 to December 7. During it, people can join, drop or switch a Medicare Advantage plan, move between Original Medicare and Medicare Advantage, or change a Part D drug plan. Scammers time their calls and texts to that window because real plan marketing is also at its loudest, so a genuine mailing and a fake one are hard to tell apart.
The Scripps report lists the tells. Medicare will not call, text or email to confirm a Medicare number, offers of a new or upgraded card are a warning sign, and promises of free gifts, genetic testing or medical equipment are red flags, since a physician orders those items. Anyone who handed over a number should hang up and report the call to 1-800-MEDICARE (1-800-633-4227). The AARP Fraud Watch Network runs a free helpline at 877-908-3360.
What to check before the open-enrollment window closes
Patients who received a kit message have a short checklist. Do not tap the link or reply. Open MyChart from the saved app or the health system’s own website. Call the plan using the number printed on the member card. Anyone who already clicked and typed in a Medicare, Social Security or bank number needs to treat that number as exposed.
The open question is what a click costs after the fact. Becker’s and Epic describe the goal as stealing personal information or delivering malicious links, but neither says how many patients have been hit. That leaves each household to decide how much to lock down before Dec. 7, when the calls are loudest.
Could one fake Medicare text open the door to more than a MyChart login?
A fake kit text is built to harvest personal details, and a Medicare or Social Security number in the wrong hands can be used well beyond a portal login. The calls reported in the weeks before Dec. 7 add more chances to hand one over.
“Scam-Proof Your Accounts in a Weekend” is a 13-page guide with ten moves that lock the three ways scammers reach money: an account already open, a new account in the victim’s name, or the owner moving the money under pressure. It covers how to freeze credit at all three bureaus, free by federal law, and sets up a family code word for fake grandchild-in-trouble calls. A large-print edition is included.
Get the 10-move weekend checklist that locks accounts before a fake Medicare text lands →
This article was produced with AI assistance and edited for accuracy against the sources linked above.
Warren Cohen is a finance writer based in Phoenix, Arizona, covering personal finance topics including credit, banking, and beginner investing. He earned his degree in business administration from Arizona State University and began his career working in consumer finance, where he gained direct experience with lending and credit systems. He now writes for personal finance websites and fintech platforms, focusing on clear, practical content that helps readers make informed financial decisions.
