Email security talking points for dental and medical practices

Dental and medical practices are good clients for small MSPs: they depend on a handful of systems, they handle sensitive information, and they usually have one person (the practice manager) who makes decisions about technology. Email is often where their exposure is most visible from the outside. This post covers how to raise it in a way that is accurate and useful.

What practice managers actually worry about

• Patients being tricked. A fake "your appointment / your bill" email in the practice's name is easy to picture and bad for reputation.
• Reminders and invoices going to spam. Missed appointments cost money.
• Doing the right thing on privacy. They know there are rules and want to be seen to follow them.
• Not breaking anything. The schedule, the imaging software and the phones must keep working.

Every email security finding can be tied to one of those concerns. Lead with the concern, not the acronym.

Three findings that matter most for practices

No DMARC, or DMARC at p=none

"Anyone can send email that looks like it came from the practice, for example a fake payment request to patients." Fixing it also helps legitimate reminders reach the inbox, because large mailbox providers trust authenticated domains more. Our two-minute DMARC explanation works well with practice managers.

Appointment and billing tools not authenticated

Practices often send through several services: the practice-management system, a reminder service, a billing provider, a newsletter tool. Each one needs to be in SPF or sign with DKIM on the practice's domain. When the list gets long, SPF can break the 10-lookup limit. The SPF lookup counter shows where a practice stands.

Email to the practice not protected in transit

Without MTA-STS, a sending server that cannot set up an encrypted connection will usually deliver in plain text. With an MTA-STS policy in enforce mode, senders that support it must use verified encryption or not deliver. It is a small project; see MTA-STS for Microsoft 365 and Google Workspace.

How to talk about HIPAA accurately

US dental and medical practices are usually HIPAA covered entities. The HIPAA Security Rule asks them to analyse risks to electronic protected health information and implement reasonable and appropriate safeguards, and it includes a transmission security standard (45 CFR 164.312(e)). It does not list specific technologies such as DMARC or MTA-STS.

So avoid "HIPAA requires DMARC". It does not. Say instead: "Your risk assessment should cover how email is protected. Authentication and encrypted delivery are standard ways to reduce two risks it will flag: impersonation and interception." If they need a formal opinion, point them to their compliance adviser. Practices outside the US have their own rules; check them rather than assuming.

A first project that is easy to approve

1. List every service that sends email for the practice (ask the practice manager; then confirm with DMARC reports).
2. Publish DMARC at p=none with a reporting address.
3. Fix SPF and enable DKIM for each sender, starting with Microsoft 365 or Google Workspace. See Microsoft 365 DKIM setup.
4. Add MTA-STS in testing mode and TLS reporting.
5. After two to four clean weeks, move DMARC to quarantine, then reject, and MTA-STS to enforce.

Deliver a short before-and-after summary at the end. Practice managers often have to show their work to the owner, and a report with an F turning into an A does that for them.

Opening the conversation

A short note to the practice manager with one finding and a one-page report beats a phone call to the front desk. Mention a concern from the list above, keep it calm, and offer a 15-minute walkthrough outside clinic hours. The cold email templates adapt easily; swap "clients" for "patients".