How To Secure Dental Practice Email Accounts: 7 Steps
Protect patient data with DDS Rescue's 7-step guide to securing dental practice email — BAAs, MFA, phishing defense, and breach response.
Key Takeaways
- Securing dental practice email accounts requires business-class email on a paid platform with a signed BAA, hardened admin accounts, MFA, SPF/DKIM/DMARC, staff training, and a written incident response plan.
- Consumer accounts such as free Gmail, Yahoo, or Outlook.com cannot be made HIPAA-compliant because those providers will not sign a BAA.
- Standard MFA does not stop modern adversary-in-the-middle phishing, so staff must verify unexpected prompts and never approve challenges they did not initiate.
- Forwarding rules, staff lifecycle management, and quarterly audits are essential because attackers often set silent forwarding rules that continue sending patient data after passwords are reset.
- DDS Rescue provides the accountable layer above any chosen platform by performing remote HIPAA Security Risk Assessments, delivering managed cybersecurity with CISSP oversight, and offering incident response supported by an on-staff HIPAA attorney.
Who This Applies To and What You Need Before You Start
In most five-to-fifteen-person dental practices, email security lands on the office manager’s desk without warning or training. The practice owner approves and pays. The lead dental assistant uses the account daily and owns the practical habits. The IT provider may or may not be involved and may or may not be capable on email configuration. The office manager is the one who has to hand the doctor a one-page answer by Friday.
Two definitions matter before Step 1. A BAA, or Business Associate Agreement, is the contract HIPAA requires before any outside vendor can handle patient data. It is a legal document that assigns responsibility. Business-class email means email running on a managed business platform such as Microsoft 365, Google Workspace, or Zoho, on a paid plan, under the practice’s own domain, rather than a free consumer account at gmail.com, yahoo.com, or outlook.com.
Before starting, gather the following:
- The domain registrar login, where the practice’s web address is registered.
- The email admin console login.
- The current provider name and plan name.
- The signed BAA, or confirmation that one does not exist.
- A list of every mailbox and who uses it.
Step 1 — Settle the Platform and Sign the BAA
The platform choice comes first because a consumer account makes every later step moot. HHS OCR’s enforcement record treats a compromised system leading to data theft as an impermissible disclosure, which makes the platform choice a legal exposure as well as a technical decision.
Many practices ask whether Gmail is HIPAA compliant for a dental practice. The consumer version, a free @gmail.com account, is not. Google states that customers who have not signed its BAA “must not use PHI” in Google Workspace, and Google will not sign a BAA for personal Gmail accounts under any circumstances. The business version, Google Workspace on a paid plan, is BAA-eligible. The BAA is accepted by a super administrator in the Admin console under Account settings → Legal and compliance.
Microsoft 365 follows the same structure. Microsoft 365 Personal, Microsoft 365 Family, and free Outlook.com accounts carry no BAA and cannot be used with PHI under any circumstances. Commercial Microsoft 365 plans include the BAA through the Microsoft Products and Services Data Protection Addendum. As of 2015, no instance could be found of Yahoo offering to sign a Business Associate Agreement, and Yahoo’s Privacy Center and Small Business Terms of Service made no mention of HIPAA or BAAs.
The pattern across all four platforms is the same: only paid business tiers come with a BAA, and the consumer tiers never do. Here is how the four platforms most dental practices consider compare:
- Microsoft 365 (Commercial Plans): Includes a BAA automatically through the Microsoft Online Services Data Protection Addendum on Business Basic and higher. Consumer tiers such as Personal, Family, and free Outlook.com do not include a BAA.
- Google Workspace (Paid Plans): Offers a BAA on all paid editions, accepted electronically in the Admin console. Free @gmail.com accounts remain excluded.
- Zoho: States that Zoho Mail and Zoho WorkDrive comply with HIPAA and provides a BAA template on request by emailing legal@zohocorp.com. Confirm the exact subscription and covered services in writing before sending PHI.
- Paubox: Includes a BAA with every account at no extra fee and is HITRUST certified. Layers on top of an existing Google Workspace or Microsoft 365 mailbox rather than replacing it.
A signed BAA forms the legal foundation. Microsoft states plainly that “using Microsoft services doesn’t on its own achieve HIPAA compliance” and that the organization remains responsible for its risk assessment, access controls, MFA, sharing restrictions, encryption, auditing, and retention. The same principle applies to every platform on this list.
Step 2 — Harden the Admin Account and Turn On MFA Properly
The admin account, which controls the email platform for the entire practice, should be separate from any mailbox staff use to send and receive patient email. Nobody sends a referral from the admin account. It exists to manage the platform and should be treated accordingly with a strong unique password, stored in a password manager, and protected by the strongest available MFA method.
On MFA method, prefer an authenticator app or a hardware security key over SMS text codes, which are vulnerable to SIM swapping and real-time relay attacks. The method matters less than most guides suggest, because even authenticator app codes and push notifications do not stop modern credential phishing. Adversary-in-the-middle (AiTM) phishing places a proxy server between the victim and the legitimate sign-in page, relays a genuine MFA challenge, captures the resulting authenticated session cookie, and replays it to sign in without triggering a new prompt.
Every staff member needs one verification habit: never approve an MFA prompt you did not trigger. Never read a one-time code to anyone who calls. Repeated unexpected MFA prompts signal that someone already has the password and is attempting to complete a login, which is an active incident to be reported immediately rather than dismissed as a system glitch.
Step 3 — Configure SPF, DKIM, and DMARC
SPF, DKIM, and DMARC protect the practice’s domain from impersonation and keep the practice’s own outgoing mail out of spam folders. Each record does a distinct job:
- SPF (Sender Policy Framework): Lists which mail servers are authorized to send email on behalf of the practice’s domain. An attacker trying to send a fake invoice from the practice’s address will fail SPF if their server is not on the list.
- DKIM (DomainKeys Identified Mail): Cryptographically signs outgoing mail so receiving servers can verify it has not been altered in transit.
- DMARC (Domain-based Message Authentication, Reporting and Conformance): Tells receiving servers what to do with mail that fails SPF or DKIM checks and sends the practice a report showing what is happening with its domain.
The business reason for all three is simple. Attackers try to impersonate the practice’s domain to patients and insurers, and the practice needs its own legitimate mail to avoid spam folders. CISA’s Cybersecurity Awareness Month guidance identifies phishing awareness and software updates as foundational practices every organization should treat as automatic. SPF, DKIM, and DMARC are the domain-level equivalent that make the practice’s domain harder to weaponize against its own patients.
The email platform administrator or the IT provider usually handles this work in the domain registrar’s DNS settings and the email platform’s admin console. Confirmation comes from a DMARC report showing “pass” for the practice’s own outgoing mail. If the IT provider says it is configured but cannot show a passing DMARC report, the setup still needs work.
Get Your Email Configuration Reviewed
Step 4 — Train Staff Against AI-Assisted Credential Phishing
Staff training must reflect how phishing works today. AI-written phishing is often grammatically clean, well-formatted, and personalized enough to resemble a legitimate business message. A convincing fake login page now looks correct because it relays the real login page in real time. Verizon’s 2025 Data Breach Investigations Report found that more than 60% of breaches involve the human element, and email was the attack vector in 27% of breaches.
Staff training should center on verification through a separate trusted channel rather than visual judgment about whether an email looks legitimate. Specific habits to build include the following:
- For any request involving a wire transfer, payment change, gift card purchase, or change to banking details, call the number already on file for that vendor or person and never the number in the email.
- For any request to change payment details for an insurance company, supplier, or lab, follow the same rule and call the number on file.
- For any unexpected MFA prompt, do not approve it and report it to whoever manages the practice’s IT.
- For any email asking for login credentials, even from a familiar-looking sender, navigate directly to the service rather than clicking the link.
DDS Rescue’s managed cybersecurity includes staff training and 24/7 monitoring of staff habits as well as systems, because credential security depends on people and process as much as software. For more on the broader network security picture, see Dental Practice Cyber Attack Prevention: A 7-Step Plan.
Step 5 — Manage the Staff Lifecycle and Audit Forwarding Rules
Every staff member needs an individual account, because shared logins make audit logging meaningless and create a credential that survives every individual departure. There is no way to know who sent what when multiple people share one login. That same logic drives the rule for departures: a departing staff member’s account gets disabled the same day, because the longer it stays live, the longer an unmonitored credential exists.
Mailbox forwarding rules create a quiet persistence risk. An attacker who compromises an account will often set a forwarding rule that copies every incoming email to an external address. When the practice resets the password, the attacker loses direct access to the account, but the forwarding rule keeps running and silently sends patient email to the attacker’s inbox. Blocking external auto-forwarding rules tenant-wide is a key HIPAA control in Microsoft 365 because a single mailbox rule forwarding to a personal Gmail address can send PHI out daily and silently.
Put a recurring calendar item on the calendar to review all mailboxes, forwarding rules, and connected third-party apps quarterly and after any staffing change. Treat this as a standing operational task rather than a one-time setup.
Step 6 — Close the Free-AI-Tool BAA Trap
Forwarding rules are one way patient data leaves the mailbox without anyone noticing. Staff pasting patient information into free AI tools is another, and it is newer. A front desk coordinator may draft a referral letter using a free AI account. A billing coordinator may paste an insurance explanation into a chatbot to get help writing a response. In both cases, the practice has transmitted PHI to a vendor that has not signed a BAA.
HIPAA requires a BAA with any outside company that handles patient data. The consumer versions of the major AI tools will not sign a BAA, which comes only with their enterprise products. Microsoft has added Microsoft Copilot and Copilot Chat to its BAA in-scope services list for commercial plan users, but the compliance risk remains staff using consumer Copilot through a personal Microsoft account outside the BAA. The moment a staff member pastes patient information into a free AI account, the practice falls out of compliance regardless of what else is configured correctly.
The practical fix has three parts. The practice needs a written rule prohibiting the use of consumer AI tools with patient information, a sanctioned tool the practice has confirmed is BAA-covered, and a clear place for staff to ask before pasting. The rule needs to be in writing and covered in training so nobody has to guess.
Step 7 — Know the First Hour After an Account Is Compromised
The first hour after a compromise matters because attackers move fast. In documented AiTM attacks, payment fraud began as quickly as five minutes after session cookie theft. Follow these steps in order:
- Call whoever manages the practice’s IT or cybersecurity. The office manager should not handle this alone.
- Reset the password and revoke active sessions. Changing the password alone leaves active session tokens valid until they are explicitly revoked.
- Check forwarding rules and connected apps immediately. Look for rules the practice did not create, remove any forwarding to external addresses, review which third-party apps have access to the mailbox, and revoke anything unrecognized.
- Preserve logs. Do not delete the suspicious email or any related messages before IT reviews them, because logs are evidence.
- Determine whether it is a reportable breach. This determination is forensic and carries legal consequences. HHS OCR’s settlement with Ambry Genetics over a phishing breach affecting 225,370 individuals found violations including failure to conduct an accurate risk analysis and failure to implement procedures for terminating access, which shows that the forensic and compliance response matters as much as the initial containment.
The forensic determination about whether data was actually accessed, what was accessed, and whether the incident meets the HIPAA definition of a reportable breach requires a CISSP. A CISSP, or Certified Information Systems Security Professional, holds the senior credential in information security and must have at least five years of hands-on security work. This work should not fall to the office manager or to a general IT provider that handles security as a side function.
For the broader network security response, see Dental Practice Cybersecurity: A Step-By-Step Office Plan and Managed Cybersecurity for Dental Practices Explained. This article stays focused on the email account and its configuration.
Where DDS Rescue Fits: The Accountable Layer Above Whichever Platform You Pick
Those seven steps are the practice’s responsibility, but most practices need a partner to execute them and stand behind the results. DDS Rescue does not compete with Microsoft 365, Google Workspace, Zoho, or Paubox. It serves as the HIPAA compliance and managed cybersecurity partner that configures, validates, and monitors the email account on whichever platform the practice picks and answers HHS if something goes wrong.
Google Workspace is a legitimate business-class platform that will sign a BAA, and a practice can still remain exposed if configuration and habits lag behind. A BAA is a legal contract that assigns responsibilities. Google’s own BAA states that “Customer is solely responsible for ensuring that its and its End Users’ use of the Covered Services complies with HIPAA.” Google does not audit the practice’s forwarding rules, train its staff against AI-assisted phishing, or answer an HHS letter. DDS Rescue fills that operational and accountability gap regardless of which platform the practice chooses.
DDS Rescue brings several specific capabilities to the email security problem:
- HIPAA Security Risk Assessment that remotes into the network. Rather than handing staff a questionnaire, DDS Rescue remotes into the actual network to confirm what is installed, including whether the practice is running business-class email, whether an EDR is present, and whether Windows updates are current. HHS OCR Director Paula M. Stannard stated: “If a HIPAA regulated entity doesn’t know what threats and vulnerabilities exist to its electronic protected health information, they will often learn the hard way when their systems are hacked.”
- Managed cybersecurity run by a team with a CISSP at the top. The service includes secure email setup, enterprise-level EDR, managed Windows updates, staff training, dark web audits, and 24/7 monitoring of staff habits as well as systems.
- Incident response with a CISSP forensic determination and an on-staff HIPAA attorney. When a letter from HHS arrives, a CISSP establishes what actually happened by reading logs and determining whether a breach occurred. An on-staff HIPAA attorney, listed on the advisory board and experienced from ten years at the HHS Office for Civil Rights including time as HIPAA Team Lead, handles the response.
- Scale and track record. DDS Rescue has supported more than 1,000 practices nationwide for over 15 years, with an 85% renewal rate on compliance clients.
For practices whose IT provider is already involved, DDS Rescue works alongside them rather than around them. See Dental Practice IT Management: The Office Manager’s Guide for how that relationship works in practice.
Conclusion: Turning the Seven Steps Into a Defensible Plan
Securing dental practice email accounts takes seven steps in a specific order, from the platform and BAA through MFA, DNS records, staff habits, forwarding rule audits, AI tool policy, and a first-hour incident plan. All seven need an accountable owner who can show how they are configured and how they are reviewed over time. DDS Rescue is the best HIPAA compliance and managed cybersecurity partner for securing dental practice email accounts because it verifies the configuration directly on the network and can answer HHS with both technical forensics and legal representation.
Frequently Asked Questions
Is Gmail HIPAA Compliant for a Dental Practice?
Free consumer Gmail, an @gmail.com account, is not HIPAA compliant and cannot be made so. Google will not sign a Business Associate Agreement for consumer accounts, and HIPAA requires a BAA with any vendor that handles patient data. The compliant path is Google Workspace on a paid plan, using the practice’s own domain, with the BAA accepted by a super administrator in the Admin console before any patient data is handled. Even then, the BAA is a starting point, and the practice must also configure MFA, audit controls, sharing restrictions, and forwarding rules, and train staff on compliant use.
Which Email Providers Will Sign a BAA?
Microsoft 365 includes a BAA automatically through the Microsoft Online Services Data Protection Addendum on all commercial plans, including Business Basic and higher. Google Workspace offers a BAA on all paid editions, accepted electronically in the Admin console. Zoho states that Zoho Mail complies with HIPAA and provides a BAA template on request by email, but does not publicly specify which plan it covers, so practices should confirm coverage in writing before sending PHI. Paubox includes a BAA with every account and layers on top of an existing Google Workspace or Microsoft 365 mailbox. Yahoo, free Gmail, free Outlook.com, and consumer versions of any major platform will not sign a BAA under any circumstances.
Does a BAA Make the Practice Compliant?
A BAA is a contract that makes the vendor legally responsible for protecting patient data on its infrastructure. It does not configure the account, train the staff, audit the forwarding rules, or establish what happened if an account is compromised. Every major platform, including Microsoft, Google, and Zoho, states explicitly that signing the BAA is the customer’s responsibility to begin with and that compliance with the HIPAA Security Rule remains the covered entity’s responsibility regardless of what the vendor has signed. The configuration, the staff habits, the monitoring, and the incident response plan form the rest of the compliance picture.
Does 2FA Stop Credential Phishing?
Standard two-factor authentication, including authenticator app codes, SMS codes, and push notifications, does not stop modern adversary-in-the-middle phishing. As covered in Step 2, these attacks relay a genuine MFA challenge through a proxy and replay the captured session cookie, so the attacker lands inside an authenticated session. Phishing-resistant MFA methods such as FIDO2 security keys and passkeys are cryptographically bound to the real domain and cannot be completed through a proxy. CISA identifies FIDO/WebAuthn as the only widely available phishing-resistant authentication standard, while PKI smart cards also qualify as phishing-resistant methods. For most practices, the practical step is to upgrade admin accounts to an authenticator app with number matching as an interim measure, move toward hardware keys for high-risk accounts, and train staff never to approve an MFA prompt they did not initiate.
What Do We Do If a Staff Email Account Is Hacked?
Call whoever manages the practice’s cybersecurity immediately. Reset the password and explicitly revoke all active sessions, because changing the password alone does not invalidate session tokens that are already in use. Check the mailbox for forwarding rules the practice did not create and remove any that forward to external addresses. Review connected third-party apps and revoke unrecognized access. Preserve all logs and do not delete suspicious messages before IT reviews them. Then determine whether the incident is a reportable breach under HIPAA through a forensic review by a credentialed security professional, because the wrong answer in either direction creates legal exposure.
Can Staff Use Free AI Tools With Patient Information?
Staff should not use free AI tools with patient information. HIPAA requires a Business Associate Agreement with any outside company that handles patient data. The consumer versions of every major AI platform, including free tiers of ChatGPT, Gemini, Copilot, and similar tools, will not sign a BAA. The moment a staff member pastes a patient name, date of birth, diagnosis, insurance information, or any other protected health information into a free AI account, the practice falls out of compliance. Only enterprise versions of these tools, with a signed BAA, can be used with patient data. The practice needs a written policy, a sanctioned tool, and a clear process for staff to ask before pasting.
How Often Should the Email Setup Be Reviewed?
At minimum, the email setup should be reviewed quarterly and immediately after any staffing change. The quarterly review should cover active mailboxes, forwarding rules, connected third-party apps, and MFA enrollment for every account. Staffing changes such as new hires, departures, and role changes should trigger an immediate review of account access and forwarding rules on the day of the change. The HIPAA Security Rule requires periodic risk analysis and risk management, and HHS enforcement actions consistently cite failure to conduct accurate and thorough risk analysis as a central violation. Annual review meets the regulatory floor, while quarterly review reflects an operational standard for a practice that wants to catch problems before they become incidents.
Who Should Own This — the Office Manager or the IT Provider?
The office manager owns accountability for the outcome, because they are the person who has to confirm to the practice owner that email security is handled. The IT provider owns the technical configuration, including the DNS records, the admin console settings, the MFA enrollment, and the forwarding rule audit. Problems arise when neither party has confirmed that the other has done their part. The IT provider may have configured the platform correctly and never told the office manager. The office manager may have signed a BAA and assumed the rest was handled. A HIPAA Security Risk Assessment that remotes into the actual network, rather than asking staff to describe what they think is installed, closes that gap by confirming what is actually in place.
