After Central Ohio Primary Care Physicians lost 1.4 million patient records to a vishing attack in August 2026, privacy officers are debating a familiar question: Do you invest in training employees to spot social engineering, or do you build technical controls that make credentials less useful to attackers?
The breach followed a pattern you've seen before. An attacker used voice phishing to obtain legitimate credentials, gained access to internal systems, and exfiltrated files containing patient names, Social Security numbers, financial data, and health information. The unauthorized access was detected and blocked on August 25, 2026, but the damage was done.
Now you're sitting in budget meetings, and you need to pick a lane. Both approaches cost money. Both promise protection. Neither is perfect.
The Case for Employee Training
Training advocates argue that technical controls fail when humans hand over the keys. You can deploy multi-factor authentication, endpoint detection, and zero-trust architecture, but if your billing coordinator reads back a one-time passcode to someone impersonating your IT help desk, none of it matters.
Training proponents emphasize the human element as both the vulnerability and the solution. Regular, scenario-based training creates a workforce that questions suspicious requests. When your staff can identify red flags like urgent requests or pressure tactics, they become your first line of defense.
Training is relatively affordable to implement. You can start with monthly phishing simulations and quarterly vishing exercises. You can measure click rates and reporting rates, showing board members a downward trend in simulation failures.
Training also scales across your entire attack surface. The same awareness that helps an employee spot a vishing call also helps them recognize a phishing email or a tailgating risk. You're building a security culture, not just blocking one attack vector.
The Case for Technical Hardening
Technical control advocates argue that training is a hope, while authentication hardening is a guarantee. Expecting a busy medical assistant to interrogate every help desk call while juggling patient check-ins is unrealistic.
This camp wants phishing-resistant multi-factor authentication (FIDO2 keys or certificate-based authentication), conditional access policies that flag unusual login patterns, and privileged access management that limits credential usefulness. If an attacker gets credentials, these controls contain the damage.
Technical controls offer measurable protection. Implementing FIDO2 authentication makes credential phishing mathematically useless. Behavioral analytics alert you when credentials access systems from unusual locations or at unusual times.
Technical controls also remove compliance uncertainty. You can point to specific HIPAA Security Rule requirements: access controls (§164.312(a)(1)), audit controls (§164.312(b)), and integrity controls (§164.312(c)(1)). You can demonstrate to OCR that you've implemented Required Specifications, not just trained people to try harder.
Hardening advocates note that training has no half-life measurement. You train someone in January, they're sharp in February, distracted in March, and by June they're back to their pre-training baseline. Technical controls don't forget.
Where Practitioners Actually Land
Most privacy officers aren't choosing sides. They're doing both, but the ratio depends on their organization's maturity and budget reality.
Smaller covered entities with limited IT budgets often start with training because it's accessible. They run monthly simulations, track reporting rates, and hope they build enough awareness to slow down attackers. They know it's not sufficient, but it's what they can afford while they work toward technical upgrades.
Larger health systems typically layer both approaches. They deploy phishing-resistant MFA for privileged accounts, conditional access for all users, and continuous training to catch the edge cases. They accept that neither approach is complete without the other.
The post-breach response from Central Ohio Primary Care Physicians follows this pattern. The organization stated it had implemented appropriate security measures prior to the incident and has since enhanced security to reduce future risk. That language typically means they're adding technical layers on top of existing training programs.
Organizations don't abandon training entirely. Even the most technically hardened environments maintain awareness programs, because attackers adapt. When credential phishing stops working, they move to QR code attacks or deepfake authorization calls. Your staff still needs to recognize when something feels wrong.
Our Take
Train your people, but don't rely on them to be perfect.
The vishing attack at Central Ohio Primary Care Physicians succeeded because someone made a human decision under pressure. That person wasn't stupid or negligent. They were busy, distracted, or convinced by a skilled attacker. Training might have helped them pause, but training alone wouldn't have stopped the breach.
Your priority should be technical controls that limit credential value. Implement phishing-resistant MFA for any account that can access ePHI. Deploy conditional access policies that flag geographic or temporal anomalies. Use privileged access management to ensure that even compromised credentials have limited reach.
Then layer training on top. Run realistic vishing simulations that mimic actual attack patterns. Teach your team to report suspicious contacts without fear of blame. Make it easy to verify requests through out-of-band channels.
The tradeoff is clear: technical controls cost more upfront but provide durable protection. Training costs less but requires continuous reinforcement. If you're forced to choose one due to budget constraints, choose the technical controls for high-risk accounts and train everyone else. But don't pretend that training alone is a sufficient response to the threat environment you're operating in.
The ransomware group Chaos added Central Ohio Primary Care Physicians to its leak site, threatened to publish the stolen data, then removed the listing. That sequence suggests either payment or successful law enforcement intervention. Either way, 1.4 million patients are now enrolled in complimentary credit monitoring services, and your CFO is looking at the cost of doing the same thing if your organization is next.
Make the investment before you're writing notification letters.
