An email lands in your inbox that looks like it came straight from your hospital. The subject line reads “Your MyChart Medicare Kit Awaits,” and it promises a free Medicare kit or senior health package. It looks routine — until you learn that hospitals across the country are now warning patients it’s a scam.
MyChart Medicare Kit Scam: Hospitals Warn Patients
MyChart Medicare Kit Scam Warning: Is That Hospital Email Real?
Health systems around the country are warning patients about fraudulent messages that borrow the MyChart name to sell a fake “Medicare kit” or “senior health package.” The messages look like they came from your hospital, but they didn’t — and clicking them can put your MyChart account and personal information at risk.
Here’s what’s actually going on, why the scam is convincing so many people, and the simple habit that protects you no matter what the next fake message says.
The Warning Going Out Right Now
Becker’s Hospital Review reported on August 13 that at least seven health systems had warned patients about emails or texts offering a “MyChart Medicare Kit” or “Senior Health Package.” The warnings have continued since then.
On August 17, ECU Health said some of its patients had received emails with the subject line “Your MyChart Medicare Kit Awaits.” ECU Health said the messages did not come from ECU Health or MyChart and were designed to get people to click malicious links or share sensitive personal or financial information.
Sentara Health issued a similar warning about messages carrying that same subject line, telling patients the emails were not coming from Sentara or MyChart and advising them not to click any link or button in the message — including an “unsubscribe” option.
This Is Not a Warning About MyChart Itself
MyChart is a legitimate patient portal used by many hospitals and doctors’ offices. It’s a genuinely convenient way to check test results, message your care team, request prescription refills, manage appointments, and review bills.
The warning is about messages that borrow the MyChart name, logo, and familiarity to make you react before you verify the source — not about MyChart becoming unsafe to use. Epic, the company behind MyChart, has said scammers are taking advantage of the popularity of the MyChart name rather than exploiting any security problem with MyChart itself. Patients can keep using MyChart normally.
Why This Scam Looks So Real
Scammers know hospital messages get attention. A note about a test result feels personal. An appointment reminder feels routine. And a message that combines MyChart with Medicare can look especially believable to someone who already receives healthcare notices, insurance information, and medical bills.
That combination is part of what makes this particular scam concerning — it’s built to feel exactly like the kind of message your hospital would legitimately send.
Use Your Own Route Into MyChart
The safest first move is simple: don’t use the link in an unexpected text or email to sign in, enter a password, give a verification code, claim a free item, or provide payment information.
Instead, open the MyChart app you already use, type your hospital’s known web address yourself, use a bookmark you already trust, or call the hospital using a phone number you find independently. If an alert is legitimate, you’ll be able to see it after reaching MyChart through a path you chose.
That difference may sound small, but it changes who’s in control. When you tap a link in an unexpected message, the sender chooses the destination. When you use your saved app, a bookmarked official site, or a phone number from a hospital statement you already have, you choose the route — and in a scam, that pause is often enough to stop the whole scheme.
What a Fake Message May Ask For
Today it might promise a Medicare kit or senior health package. Another message might claim your MyChart password has expired, that you need to confirm an appointment, update your insurance information, view a lab result, pay a balance, or claim a refund. Some may offer a free gift, prize, coupon, or health-related item, or pressure you to act immediately.
The wording changes, but the goal is usually the same: get you to click, enter information, make a payment, or give the scammer access to something they shouldn’t have.
MyChart’s own safety guidance specifically tells users to be skeptical of free offers. It says scammers may promise gifts or prizes in exchange for information, and that MyChart does not run giveaways.
A Real Verification Code Proves Nothing
Here’s a warning many people miss: a real one-time verification code is not proof that the person asking for it is real. If someone already has your username, or is trying to reset your account, that code may be the final piece they need.
Picture a caller who says they’re from your hospital. They tell you there’s been a problem with your account and say they’re going to send you a verification code. A real code arrives on your phone — then the caller asks you to read it back. The fact that the code itself is real doesn’t make the caller real.
Epic says that it, and your healthcare organization, will never ask you for your password or verification codes by phone, text, or email. The only safe place to enter those credentials is inside the MyChart website or app while you’re signing in yourself.
Knowing Your Details Doesn’t Prove They’re From Your Hospital
A caller may know your name, your town, or even which hospital or healthcare organization you use. That doesn’t prove they work for it. Personal information can come from public sources, previous data breaches, social media, or somewhere else entirely.
If a caller asks for a password, verification code, or other sensitive information, the calm response is to tell them you’ll contact the hospital directly — then end the call. Our guide to a related Medicare card scam warning walks through the same “who started the contact” test in more detail, and it’s worth knowing for any call that claims to be about your Medicare or hospital account.
Check the Address, Not Just the Name
Look beyond the name that appears at the top of an email or text. A fake sender can use a display name that says “MyChart” or the name of your hospital. The more useful details are the full email address and the complete web address where a link would actually take you.
Misspellings, extra words, unfamiliar domains, poor grammar, and messages that don’t match how your hospital normally communicates are all warning signs. ECU Health specifically advised patients to confirm the sender’s email address, watch for spelling and grammar problems, be cautious of free kits, rewards, coupons, gift cards, or prizes, and resist pressure to act immediately.
But a message doesn’t have to look sloppy to be fraudulent. That’s why logging in independently is safer than trying to decide whether every email looks convincing enough to be real.
Real MyChart Messages Do Exist Too
MyChart isn’t one identical website for every patient — each healthcare organization has its own MyChart address and makes its own decisions about features and notifications. That can make a generic-looking message harder to judge on its own.
Hospitals may genuinely email or text you that a new message, result, appointment update, or bill is waiting. So the useful question isn’t whether a hospital would ever contact you that way — they may. The better question is whether you’re about to enter private information on a page you reached through a path you trust. Opening your trusted app or hospital website yourself handles both possibilities without forcing you to guess.
The official MyChart website can help you find the correct MyChart site for your healthcare organization, and your hospital’s help desk can tell you the right way to sign in. It’s worth knowing that trusted route before an urgent-looking message ever arrives.
Why It’s Worth Locking Down Your Account
A MyChart account can hold much more than a balance. Depending on your healthcare organization, it may include health information, medications, test results, appointment details, messages with your care team, insurance information, billing details, and contact information. Someone who gains access may also try to change the information tied to the account.
Securing MyChart doesn’t have to be complicated. Use a unique password you don’t reuse for email, banking, shopping, or social media. Turn on two-step verification if your account offers it — MyChart also supports additional security options like passkeys in some situations. And keep the email account and phone number connected to MyChart protected, since those may be used for account recovery and verification codes.
If a Message Already Arrived and You Haven’t Clicked
If you have not clicked anything, don’t interact with the message at all. Don’t click the link, don’t open an attachment, and if you believe it’s a phishing email, don’t even use the “unsubscribe” button inside it.
Sentara and ECU Health both warned recipients not to click links or buttons in these messages. ECU Health advised people to report the message and then delete it.
If You Already Clicked
Start by closing the suspicious page and don’t enter anything else. Then go to the official MyChart app or website on your own. If you entered your MyChart password on a suspicious page, change it, and review the email address, phone number, and other contact information on your account for changes you don’t recognize.
Contact your healthcare organization’s MyChart support desk, explain what happened, and ask what they recommend for your account. Those steps match MyChart’s own fraud-recovery guidance, which recommends resetting your password, reviewing the contact information on your account, and contacting your healthcare organization’s help desk if you suspect fraud.
If you entered payment card or banking information, contact that financial institution using a trusted phone number — the one on the back of your card or on an official statement, never one from the suspicious message. And if you gave away sensitive identity information, you may need to take additional identity-theft recovery steps.
Four Things to Remember
- Use your own saved app, bookmark, or phone number to reach MyChart — never a link from an unexpected message.
- Keep your MyChart password and any verification code private, even from someone who sounds official.
- Be suspicious of any unexpected offer of a free kit, gift, or benefit tied to Medicare or your hospital.
- When something feels off, call your healthcare organization directly using a number you find yourself.
Frequently Asked Questions
Is MyChart itself unsafe to use?
No. MyChart is a legitimate patient portal, and Epic has said this scam is about criminals borrowing the MyChart name — not a security problem with MyChart itself. You can keep using MyChart normally, as long as you get there through your own app, bookmark, or a web address you type yourself.
What is the “MyChart Medicare Kit” scam?
It’s a phishing email or text that uses a subject line like “Your MyChart Medicare Kit Awaits” and promises a free Medicare kit or senior health package. Multiple hospitals, including ECU Health and Sentara Health, have confirmed the messages are not from them or from MyChart and are designed to steal personal or financial information.
How can I tell a real hospital message from a fake one?
Don’t judge it by how convincing it looks or which name appears at the top. Instead, open MyChart yourself through your app, a saved bookmark, or a web address you type — never through a link in the message. If the alert is real, you’ll find it waiting for you there.
Is a verification code enough to prove someone is calling from my hospital?
No. A real verification code sent to your phone can still be misused by a scammer who already has other pieces of your information and just needs you to read the code back. Epic and MyChart will never ask for your password or a verification code by phone, text, or email.
What should I do if I already clicked the link?
Close the page without entering anything else, then go to the official MyChart app or website on your own. Change your MyChart password if you entered it, review your account’s contact information for changes, and contact your healthcare organization’s MyChart support desk. Contact your bank as well if you entered any payment or banking information.
Should I use the unsubscribe link in a suspicious message?
No. Hospitals warning about this scam, including Sentara and ECU Health, have specifically told patients not to click any link or button in these messages, including “unsubscribe.” Report the message and delete it instead.
The Bottom Line
Today the suspicious message may say “Your MyChart Medicare Kit Awaits.” Next time, the wording could be completely different — a test result, an insurance update, a refund, a free gift, or a problem with your account. You don’t have to memorize every version of the scam.
Use your own route to MyChart, keep your password and verification codes private, be suspicious of unexpected free offers, and call your healthcare organization directly when something feels off. A few extra seconds can protect your medical privacy, your account access, your personal information, and possibly your money.
If you know someone who uses MyChart — especially someone on Medicare who might see an offer for a “Medicare Kit” and assume it’s legitimate — consider sharing this warning with them.
Money Instructor provides educational information only and is not affiliated with MyChart, Epic, or any specific hospital or healthcare organization. This content does not constitute medical or legal advice. If you believe you’ve received a phishing message or already shared information with one, contact your healthcare organization’s MyChart support desk directly, and report the message to the Federal Trade Commission at ReportFraud.ftc.gov.