Impersonating the MyChart patient portal, a wave of near-identical emails and text messages has been landing in patients’ inboxes promising a free “MyChart Medicare Kit” that doesn’t exist. The messages carry the MyChart logo and promise a free “MyChart Medicare Kit” or “Senior Health Package,” and dozens of hospitals and health systems around the country have spent August posting their own warnings that the messages are fake. Neither the health systems patients receive them from, nor Epic, the company that licenses the MyChart platform, has anything to do with the offer.
The Email That Promises a Free Medicare Kit
The lure typically opens with a message telling the recipient they’ve been “selected” for a free 2026 Medicare Health Kit, sometimes framed as a delivery notice for a kit already on its way. Anyone who clicks through lands on a page built to look like it belongs to MyChart, showing today’s date and a banner claiming that more than $300,000 in MyChart products have already been given away, followed by a short “survey” about the person’s experience with the portal. A countdown clock ticks down while the page tells the visitor a reward is running low — a pressure tactic, not a real deadline, since the same reward and the same “limited stock” message appear no matter what answers are entered.
Free retirement updates: A quiet rule change can shrink your Social Security or Medicare check, and no one warns you. The free Retirement Shield newsletter catches these early and tells you what to do. Get it free.
From a ‘Free Kit’ to a Credit Card Number
The reward itself is where the scam earns its money. After the visitor “wins” the kit, valued at $149 but offered at no cost, the page asks for a small shipping fee and a full set of personal details: first and last name, email address, phone number, and mailing address. A second page then asks for a credit card number, expiration date, and security code, sometimes dangling a small discount for paying with a particular card brand. No kit is ever shipped. According to Epic’s own account of the scheme, the personal information collected on the “free kit” page is harvested even if a visitor closes the browser before entering payment details, and it gets reused to fuel a fresh round of scam calls, texts, and mailers once it’s sold on.
How Two Health Systems Are Telling Patients to Respond
GBMC HealthCare, the Baltimore-area health system, posted its own alert confirming it is aware of emails and texts impersonating MyChart with exactly this “Medicare Kit” and “Senior Health Package” language, stating plainly that the messages are not from GBMC and that there’s no indication GBMC’s systems or MyChart itself have been compromised. Its guidance to patients: delete the message, don’t click any link or button — including an “unsubscribe” link, which can lead to another dangerous site — and don’t forward it to anyone else.
SGMC Health in Valdosta, Georgia, issued a nearly identical warning, telling patients not to click links, open attachments, reply, or hand over personal, financial, insurance, or Medicare information if they receive one of these messages, and to reach MyChart only through the health system’s own website or app. The two systems’ independent statements line up almost word for word with what Epic itself describes, and Becker’s Hospital Review had counted at least 41 health systems posting similar warnings as of its August 27, 2026 tally, a number the trade publication says keeps growing.
Epic Says the Portal Itself Was Never Hacked
The distinction that matters for patients is between a scam that borrows a trusted name and an actual breach of the underlying system. Epic has said the increase in these scam attempts traces to the popularity of the MyChart brand rather than any security problem with the platform, and that patients can keep using MyChart normally. Epic’s help page notes that real MyChart communications always come from a patient’s own healthcare organization or from MyChart Central, and that Epic and healthcare organizations will never ask a patient to change the email address or phone number they have on file to one the patient doesn’t control — a request that shows up in some versions of the fake emails.
How to Tell a Real MyChart Message From a Fake One
Before clicking a link, logging in, or entering payment details from any MyChart-branded message, check the sender’s full email address and the exact web address a link points to; small misspellings or extra words are the most common tell. Anyone who wants to verify a message can call their healthcare organization’s help desk directly, or look up their organization’s official MyChart site using the search tool at mychart.org rather than trusting a link in an email or text. If a password or verification code was ever entered on a suspicious page, resetting it through the official app or website — and calling the bank to replace a card if payment information was entered — remain the two steps that matter most after the fact.
This article was produced with AI assistance and reviewed by a human editor. Figures are linked to their primary sources; where a claim could not be verified from the public record, we say so.
More Financial Reading
