A faculty physician at the University of California San Francisco Medical Center received an e-mail last fall appearing to be from the hospital’s information technology staff. The e-mail requested the doctor’s login information in order to perform routine security upgrades to the system. Because it seemed like an ordinary request the physician sent the information.

“