41 Hospital Systems Are Warning About a “MyChart Medicare Kit” Email. There Is No Kit — and the One Tell Is What the Link Asks You to Type.

A phishing wave is borrowing the one health login you actually trust, six weeks before Medicare Open Enrollment. Here’s how it works, what it’s really after, and the two-second habit that makes it harmless.

“Your MyChart Medicare Kit Awaits!” That’s the subject line that has now pushed 41 hospital systems, from Cleveland Clinic and Mass General Brigham to Mount Sinai, MD Anderson, Emory, and Northwell, to post warnings for their patients (Becker’s Hospital Review, Aug. 27, 2026). The email, and a text version, looks like it came from MyChart, the patient portal you use to read lab results and message the doctor. It offers a free “Medicare Kit” or “Senior Health Package.” There is no kit. There is a link, and what’s on the other side of it is the point.

What’s happening

Epic, the company behind MyChart, says the messages don’t come from it or from any hospital. It has been warning since July of “an uptick in scammers using the MyChart name or logo to create deceptive emails, text messages, phone calls and websites that appear official,” and in August it shared samples: one links to a fake MyChart site that shows made-up medical records to look real, another announces a free “2026 Medicare Health Kit” (AHA News, Aug. 24, 2026). Epic’s Trevor Berceau says the surge “is due to scammers taking advantage of the popularity of the MyChart brand rather than any security concern,” and that patients “can continue to use MyChart as normal” (Becker’s, Aug. 27, 2026, quoting MyChart.org, July 27, 2026).

The timing isn’t an accident. Medicare Open Enrollment runs October 15 through December 7 (Medicare.gov), and the pre-season noise has already started. One recently retired beneficiary in Cincinnati told a local consumer reporter she gets Medicare-related calls several times a day despite being on the Do Not Call registry, and that the callers never say who they work for (WCPO, Aug. 31, 2026). A “kit” email lands in an inbox that’s already braced for Medicare mail.

What this means for your wallet

The kit is free because it doesn’t exist. What the page on the other end of the link wants is worth more than a package: your MyChart username and password, your Medicare number, or both.

Your portal login opens your full medical record, your prescriptions, your doctors’ names, and your messages to them, which is everything a crook needs to make the next scam call sound legitimate. Your Medicare number is the bigger prize. Medicare’s own guidance says to guard it like a credit card, because a stolen number lets someone bill Medicare for equipment, tests, and services in your name (Medicare.gov, “4 Rs for Fighting Medicare Fraud,” publication 11610), and the Consumer Financial Protection Bureau adds that a fraudster with your Medicare and Social Security numbers can open credit cards or bank accounts in your name (CFPB, “Guard your new Medicare ID card to avoid fraud”). The bogus claims show up on your Medicare Summary Notice months later, and every one of them has to be disputed by you.

AARP’s Amy Nofziger, who runs victim support for its Fraud Watch Network, put it plainly: Medicare “knows your Medicare number” and isn’t going to call, text, or email to confirm it, and offers of free gifts, genetic testing, or medical equipment are a red flag because anything you actually need “will go through your physician” (WCPO, Aug. 31, 2026).

The one tell

A real MyChart message never needs you to type anything into a link. If your hospital has something for you, it sits inside the portal, and you see it by opening the app or typing your hospital’s MyChart address yourself. So the tell is the ask: an email or text that offers you something and needs you to sign in through its link to get it (Becker’s, Aug. 27, 2026).

Two backups the hospitals themselves recommend: look at the sender’s actual address, not the display name, and read the message once for grammar, because these are sloppy (Becker’s, Aug. 27, 2026). And the word “kit” itself: Medicare mails a card and the annual Medicare & You handbook (Medicare.gov); it doesn’t ship packages, and your hospital doesn’t ship them on Medicare’s behalf.

What to do

• Got the email or text? Delete it without clicking. Don’t reply, don’t call the number in it (Becker’s, Aug. 27, 2026).
• Curious whether your hospital really sent something? Open the MyChart app, or type the portal address you already use. If there’s nothing waiting, there was nothing.
• Already clicked and signed in? Change your MyChart password now, from the real app. If you typed your Medicare number, call 1-800-MEDICARE (1-800-633-4227) and say so; read your next Medicare Summary Notices line by line for equipment or visits you didn’t get (Medicare.gov, publication 11610).
• Want to talk to a person? The AARP Fraud Watch Network Helpline is free at 877-908-3360 (WCPO, Aug. 31, 2026). Report the message at ReportFraud.ftc.gov.

The takeaway

The portal is fine. Keep using it. Just walk in the front door, the app or the address you type, and never through a link that came looking for you. A kit that needs your password first isn’t a gift; it’s a receipt.

This is information, not financial, legal, or medical advice. Senior Savers is independent and not affiliated with Medicare, Epic, or any hospital system. Talk to a licensed professional about your situation.

Want the plain-English version of the week’s scams and money news? Join the free Senior Savers newsletter. No sales calls, ever. You’ll hear from us only when you ask to.