A new survey of U.S.-based clinics and hospitals has revealed less than one in five institutions have correctly implemented basic phishing and spoofing protection.