{"id":"sec-hc-patient-list-request-reply","audience":"healthcare","category":"security","track":"security","technique":"context","title":"Decline an emailed request for a patient list","free":false,"task":"Someone claiming to be from your billing vendor emailed asking for a patient list. Your policy: patient information is never sent by email, even to known vendors, and vendors must request data through the secure vendor portal. Write a polite reply of at most 3 sentences that says so, and don't use any contact details from their email. Sign off with 'Thank you, Riverbend Billing Office'. Plain text, under 70 words.","materialLabel":"The email and your policy (attached to your prompt automatically)","material":"From: \"Medi-Claim Partners Support\" <support@medi-claimpartners-help.example.net>\nTo: billing@riverbend.example.org\nSubject: URGENT: missing claims data\n\nHello,\n\nWe are reconciling October claims and are missing records. Please email us a spreadsheet of all patients seen in October with names, dates of birth and insurance ID numbers by end of day so claims aren't rejected.\n\nIf easier, call our new support line (555) 019-7731.\n\nThanks,\nJordan\nMedi-Claim Partners\n\n---\nContract file - Medi-Claim Partners (billing vendor since 2023):\n- Account manager: Lisa Park, (555) 014-6600, lisa.park@medi-claimpartners.example.com\n- Secure Vendor Portal: linked from the Riverbend partner page (vendors log in with their own account)\n- Last data request: September, through the portal, for 12 claims.\n- Contract renews in March 2027.","rules":[{"type":"maxSentences","max":4},{"type":"plainText"},{"type":"maxWords","max":70}],"mistakes":[{"title":"Helping too much","why":"The AI offers to call the number in the email or send partial data.","fix":"Say: \"Don't use any contact details from their email.\"","checks":["r1"]},{"title":"Not naming the process","why":"The AI says 'we can't share this' without saying how vendors should ask.","fix":"Add: \"Point them to the secure vendor portal.\"","checks":["r0"]},{"title":"Wrong tone or sign-off","why":"The AI calls it a scam or signs 'Best regards, [Name]'.","fix":"Ask: \"Polite, no accusation. Sign off: Thank you, Riverbend Billing Office.\"","checks":["r2"]},{"title":"Too long","why":"The AI explains privacy law in the reply.","fix":"Limit it: \"At most 3 sentences.\"","checks":["maxSentences","maxWords"]},{"title":"Letting markdown in","why":"AI adds bold and headings by default, and in an email they show up as stray symbols.","fix":"Add: \"Plain text only, no bold, no headings.\"","checks":["plainText"]}],"promptHints":[{"label":"Points to the portal","patterns":["portal","process","policy"]},{"label":"Avoids their contact details","patterns":["don'?t (use|call|include)","their (number|contact)","019-7731"]},{"label":"Sets tone and sign-off","patterns":["polite","sign off","thank you, riverbend","no accus"]},{"label":"Limits the sentences","patterns":["\\b(3|three)\\b.{0,10}sentences","sentences"]},{"label":"Asks for plain text","patterns":["plain","no bold","no markdown","no formatting","no headings"]}],"hint":"Data requests by email are a classic trick, but the reply should stay polite. Tell the AI the rule, the right process, and what not to use from the email.","rubricLabels":["Says patient information can't be sent by email and directs the request to the secure vendor portal","Does not use the (555) 019-7731 number or reply-to details from the email (mentioning confirming through your existing contact is fine)","Polite, no accusation, and ends with 'Thank you, Riverbend Billing Office'"]}