ok, it seems like you have 'know how' than the average healthcare provider when it comes to IT so I am not going to insult or bore the shit out of you. 😀
I would just recommend you start by looking at your email provider, it is obviously not filtering emails properly if it is allowing a lot of phishing emails through.
If I can be of anymore help, feel free to reach out as I have much more that I can provide, I just do not want to overstep.