Phishing simulation for clinics
A phishing simulation for a clinic or a practice sends the medical and administrative staff decoy emails that imitate typical requests, and measures who opened, clicked or reported. With PhishingU you can run it yourself from ₪999 per one-time campaign (up to 100 employees), in Hebrew and with a summary report.
Last updated: 19.10.2026 | Written and reviewed by the PhishingU team
* Setup in under 15 minutes, with no technical knowledge - one simple action is required from IT (allowlisting the sender), and launch is subject to a security review of up to one business day.
Why clinics are a phishing target
- A clinic holds patients' medical information, which is especially sensitive information, so a leak incident may be severe.
- Medical staff work under time pressure and receive emails from many parties, which makes it easier for a fake request to get through.
- Small clinics and practices usually have no dedicated security team, and email is sometimes shared by several people.
Three scenarios that suitclinics
The scenarios are general types of requests for practice, with no impersonation of a real brand.
What is measured inclinics
- Whether the medical and administrative staff open links in emails that look like referrals or test results.
- Whether some employees share a computer or a mailbox, and whether this affects the results.
- How long it takes until someone reports a suspicious email.
How to prepare the team
- Coordinate the sending time with quiet hours at the clinic.
- Explain to staff that patient results are not to be opened from a link in an email, but from the official system.
- Make sure one person receives reports of suspicious emails.
What you get at the end
A summary report with open, click and report rates, and a certificate of participation in awareness training. The certificate is evidence of training that helps meet part of the requirements of Amendment 13; it is not a confirmation of full compliance with a law or a standard. Payment is a one-time payment from ₪999 per campaign (up to 100 employees), with no subscription. See the The full price list.
Frequently asked questions
Why does a clinic need a phishing simulation?
Because it holds sensitive medical information and the staff receive many emails. A simulation shows which scenarios work and lets you train the staff accordingly.
Does the simulation interfere with day-to-day work?
No. The emails are decoy messages, and anyone who clicks lands on a short explanation page. The sending can be scheduled for hours that suit the clinic.
Does the certificate prove compliance with privacy requirements?
No. The certificate of participation is evidence of awareness training that helps meet part of the requirements of Amendment 13, and it is not a confirmation of full compliance with the law. We recommend checking the clinic's obligations with a legal advisor.