Protecting patient identities as QR codes open up new cybersecurity risks

by Experian Health 5 min read February 22, 2022

Protecting-patient-identities-as-QR-codes-open up-new-cybersecurity-risks

QR codes made an unexpected comeback during the pandemic. They offered a contactless gateway for individuals to check in to venues, log COVID-19 test results, help trace the virus spread and more. Restaurants and retailers embraced the technology as a way to welcome back consumers with touch-free access to online menus and digital payments. Previously seen as gimmicky and hindered by dependence on specific apps, these scannable squares can now be read using most smartphone cameras. With new use cases emerging during the pandemic, “quick response” codes are suddenly relevant again. However, the growing popularity of QR code technology opened the door to new cybersecurity risks, so providers must remain proactive with protecting patient identities.

A 2020 survey found that almost half of consumers said they’d noticed an increase in QR codes since the first shelter-in-place orders. Online payment provider PayPal reported that a new merchant was added to its QR code payment option every 28 seconds in the first quarter of 2021.  Cybercriminals are capitalizing on consumer trust in QR codes to harvest personal data or install malware on devices. This leaves healthcare organizations and their patients vulnerable to fraud, especially given the increased adoption of digital healthcare technology during the pandemic. Providers must remain vigilant with protecting patient identities from QR code cybersecurity risks.

How do QR codes threaten patient identities?

QR codes hold far more data than traditional barcodes. They can be easily generated and fixed to any surface, ready for users to scan with their smartphones. They are primarily used to store URLs, which take the user directly to a website.

But while savvy consumers are aware of the risks associated with clicking on a suspicious link in an email, QR codes are intrinsically trusted. It’s much harder to tell if a QR code is legitimate or not. Scanning a QR code is essentially the same as clicking on an unknown link. A study by MobileIron found that while 67% of consumers say they can identify a suspicious URL, less than 30% can identify a malicious QR code. Mike Bruemmer, VP of Experian Data Breach Resolution and Consumer Protection, says that “QR codes are the new stealth threat vector. Regardless of their application, no one can tell a fake code that launches malware on your device from a legitimate one.”

There are two main risks for patients. Firstly, they may click on a QR code that takes them to a web page that appears legitimate, prompting them to share personal data or log-in details. This information is then harvested by cybercriminals. This form of QR code phishing, known as “quishing,” puts the user at risk for spam, adware and identity theft. Secondly, the user may scan a QR code that takes them to a malicious site that installs malware on their device, which will then steal and package the user’s personal and financial data. The QR code can even be used to generate actions that appear to come from the user, such as making payments, sending emails, sharing locations or following social media accounts.

In January 2022, the FBI issued a warning about cybercriminals using QR codes to redirect victims to malicious sites that steal login and financial information. Users are urged to practice caution when entering personal information after scanning a QR code.

How can healthcare organizations help with protecting patient identities against QR code cybersecurity threats?

For healthcare organizations, the concern is that if patients fall victim to a QR code scam, bad actors can steal personal identification data to access patient portals and other digital services. This information can be used to access medical services without paying, obtain medications illegally, or submit false health insurance claims, creating ongoing financial and administrative stress for patients. Or, if cybercriminals use captured information to log on as staff members there’s an added risk of further data breaches from inside the provider’s network.

Healthcare organizations have a few options to help patients protect themselves from QR code scams:

  • Targeted awareness-raising campaigns are a simple way to encourage patients to make sure their devices are updated with the latest security patches. Patients can be warned to watch out for suspicious activity, such as when a QR code redirects to a page that asks for personal details. They might also choose to ask for a direct URL, instead of using the QR code.
  • Securing access to patient portals and verifying patient identities are practical measures to ensure that the person accessing the account is who they say they are. Another best practice in patient portal security is to take a multi-layered approach. This includes two-factor authentication, device recognition and additional checks on risky requests. By securing patient portals, providers can be proactive at protecting patient identities and reduce the risk of fraud during enrollment.
  • Integrating patient identity management tools can also help verify the patient’s identity from the very first registration touchpoint all the way through their healthcare journey. Automated identity checks and algorithmic matching based on Experian Health’s unrivaled reference data can help ensure that the patient’s record is accurate and complete.
  • Offering alternative secure methods for contactless patient payments and patient access are other options to make the patient experience more secure. For example, providing patients with their own mobile payment option means they can pay bills securely and access payment plans right from their phone. Experian Health also offers various safe and secure registration and scheduling solutions that will give patients a seamless patient access experience and help protect them from identity theft. Victoria Dames, VP of Product Management at Experian Health, says that patients have come to expect a smooth and secure digital experience: “Providers are focused on patient data security in adherence to multiple health policies, like HIPAA, but also to maintain confidence with patients. They [patients] are embracing digital solutions and expecting appropriate security measures are in place.”

Find out more about how Experian Health can help healthcare providers with protecting patient identities and close the door to QR code scammers. Experian Health can also help prevent other identity theft and fraud, verify that patients are who they say are, and provide safe, secure and convenient ways for patients to get the care they need.

Related Posts

Andy’s New WP Workflow Test Article Using Quick Edit

Key takeaways: Revenue cycle teams can use automation to reduce repetitive work and apply AI where data-driven prediction, matching or prioritization can improve a workflow. Experian Health’s 2025 State of Claims survey found that 41% of providers now face denial rates of 10% or higher, while 68% say submitting clean claims is more challenging than a year ago. Patient Access Curator™ (PAC) uses AI to support front-end data validation and insurance discovery, while AI Advantage™ helps teams predict denial risk and prioritize denial follow-up. Artificial intelligence (AI) and automation can support administrative work in healthcare. In the revenue cycle, teams depend on accurate information, timely decisions and efficient follow-up to keep claims moving. In revenue cycle management, AI and automation can help organizations reduce manual checks, find data gaps, predict denial risk and prioritize work queues. These tools are most useful when they support staff judgment, payer expertise and compliance oversight. They can handle repetitive, data-heavy tasks so staff can focus on exceptions and decisions that need human review. In 2023, McKinsey & Company reported that research suggests effectively deploying automation and analytics could eliminate $200 billion to $360 billion of spending in U.S. healthcare. For revenue cycle leaders, the practical question is where to apply those capabilities first. The case for applying AI and automation in healthcare Revenue cycle teams juggle many daily tasks. Staff collect and verify patient information, confirm eligibility, identify the right payer, submit clean claims, monitor status, work denials and manage collections. Small data gaps at the beginning of the process can create downstream rework and delays. Rework also consumes staff time, adding to these operational pressures. As costs rise and revenue cycles tighten, there is increasing pressure to do more with less. Experian Health’s 2025 State of Claims survey found that 54% of providers say claim errors are increasing and 90% of claim denials are reworked with at least some human review before resubmission. Providers are also managing broader financial and administrative pressures. The American Hospital Association has reported that prior authorization requirements, claim audits, denials and other payer policies add administrative burden and cost for hospitals and health systems. These requirements also consume staff time to appeal denials and manage payer processes. AI and automation are different but complementary. Automation follows defined rules to complete repeatable work. AI models can identify patterns in data, predict risk and help teams decide where to focus attention. When used together, they can support more consistent revenue cycle workflows. How AI and automation can support revenue cycle workflows Revenue cycle management automation and AI are most useful when tied to a specific workflow and a measurable operational problem. The goal is to help teams act earlier, reduce avoidable rework and focus staff time where judgment is needed most. For example, automation can complete rule-based eligibility checks. AI can help identify claims with a higher likelihood of denial. In insurance discovery workflows, AI can also help identify coverage that wasn’t captured at registration. When these tools fit into existing workflows, they can support more consistent decisions and reduce manual work. Three practical applications include: 1. Improving front-end data quality with Patient Access Curator Patient and coverage information collected early in the revenue cycle can affect downstream claim outcomes. Incomplete or outdated demographic details, eligibility responses, coordination of benefits or Medicare Beneficiary Identifier information can create problems that lead to claim delays or denials later in the cycle. Experian Health’s Patient Access Curator helps prevent claim denials by validating demographics, eligibility, insurance discovery, coordination of benefits and Medicare Beneficiary Identifier data in seconds. PAC’s AI and machine learning capabilities help improve match accuracy, coverage sequencing and data confidence by writing the validated data back into the host system and sequencing payers before the claim is created. This automates work that would otherwise require manual coverage checks. 2. Using insurance discovery to find coverage not captured at registration When active coverage isn’t identified during registration, claims may be delayed or submitted with incomplete insurance information. Insurance discovery looks for coverage that may not have been captured during registration. Patient Access Curator includes insurance discovery as part of its front-end validation workflow. It can help identify and correct missing or incorrect insurance information so claims can be submitted with more complete coverage data. 3. Using AI to prevent and prioritize denials Even with strong front-end processes, some claims still require additional attention. AI can help claims teams decide which claims to review before submission and which denials to work first after payer response. Experian Health’s AI Advantage supports two denial management use cases:1. AI Advantage – Predictive Denials uses a client’s historical claims data and Experian’s knowledge of payer rules to identify claims with a high likelihood of denial before submission so teams can take corrective action.2. AI Advantage – Denial Triage uses AI to segment denials and identify those with the highest potential for reimbursement. This approach can help teams prioritize with more confidence. Rather than treating every claim or denial the same way, teams can use predictive models to focus on the work that needs the most attention. Potential benefits of AI and automation in the revenue cycle A high-performing revenue cycle depends on timely, accurate and consistent work. AI and automation can help providers modernize that work without losing the expertise of the people who manage complex payer and patient situations every day. When applied to the right workflows, these tools can help organizations: Reduce manual data searches that take staff away from higher-value work Improve front-end data quality before claims are created Identify missing or incorrect coverage information earlier Spot claims that may be at higher risk of denial Prioritize denied claims by potential reimbursement Reduce rework caused by inaccurate or incomplete information Give staff more consistent information for follow-up decisions A focused AI strategy starts with the workflow problem, uses data that is relevant to that problem and keeps staff in control of judgment-based decisions. A more proactive approach to revenue cycle management Revenue cycle teams can move from reactive work toward a more proactive approach: catch errors earlier, validate coverage before claims are created and prioritize the claims and denials that need the most attention. Experian Health offers revenue cycle solutions that use AI and automation in targeted ways to support front-end data quality, reduce rework and manage denials. Patient Access Curator supports registration and coverage validation, while AI Advantage supports denial prediction and triage. Learn more about Experian Health’s Patient Access Curator and AI Advantage.

October 2, 2026 by Andy.Monte@experian.com
Experian Health ranked #1 in Best in KLAS for 2025

Experian Health is very pleased to announce that we've ranked #1 in the 2025 Best in KLAS: Software & Services report, for our Contract Manager and Contract Analysis product, for the third consecutive year. Contract Manager, when paired with Contract Analysis, empowers healthcare providers by ensuring payers comply with contract terms, identifying and recovering underpayments, and arming them with real claims data to negotiate contracts. This enables providers to negotiate more favorable terms and maintain financial stability.  Clarissa Riggins, Chief Product Officer at Experian Health, says, “In the ever-evolving healthcare landscape, our Contract Manager solution has once again been recognized as the #1 Revenue Cycle Management tool by KLAS for the third consecutive year. This prestigious ranking underscores the significant value our solution delivers to our clients by identifying underpayments and facilitating revenue recovery. We are honored to continue supporting our clients with innovative solutions that drive financial success and operational efficiency.”  Learn more about how Contract Manager and Contract Analysis can help your healthcare organization validate reimbursement accuracy, recover underpayments and boost revenue.   Learn more Contact us

February 5, 2025 by kelly.nguyen
How to increase patient engagement

Learn how providers can increase patient engagement, why it matters and key strategies that deliver improved end-to-end patient experiences.

January 30, 2025 by Experian Health

Spotlight test

Spotlight Description

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

Sticky Subscribe Title

Sticky Subscribe Description
Sticky Subscribe

Testing Spotlight Paragraph block

Testing the spotlight block header

Archive Testing

Categories