Email security for dental practices: what to protect and how

A dental practice runs on a handful of inboxes. The front desk, the office manager and the owner dentist handle patient questions, insurance claims, lab cases, supply orders and payroll from the same few accounts, usually without an IT department. This guide covers the email threats that matter most to dental offices, what HHS and the ADA have published about them, and a checklist your office manager can work through in an afternoon.

Why are dental practices targeted by email attacks?

Dental practices are targeted because a single email account often leads to patient records, insurance information and the practice's money, and small offices rarely have someone watching for attacks. Phishing is an email that pretends to come from someone you trust to get you to click a link, open a file or hand over a password. In a dental office, the trusted senders are easy to guess: the practice management software vendor, the insurance clearinghouse, the dental lab, the supply company, the payroll provider and the ADA itself.

HHS's 405(d) program, which publishes cybersecurity guidance for healthcare, describes exactly this pattern. Its email phishing flyer gives the example of staff receiving a message that appears to come from IT support at the practice's patient billing company, asking them to change their billing software password. The link leads to a fake sign-in page, and the stolen credentials open financial and patient data.

The dental profession has seen this directly. In September 2025, ADA News reported a fake ADA membership email that threatened suspension unless the recipient opened a "payment advice document" within 24 hours (ADA News).

Ransomware is the other serious risk. Ransomware is malware that encrypts your files and demands payment. The FBI's 2025 IC3 report says the ten ransomware variants most reported to it most affected three critical infrastructure sectors, one of them Healthcare and Public Health. For a dental office, encrypted imaging and scheduling data can stop the chairs.

What email threats do dental offices actually see?

Dental offices see general phishing plus several lures built around how a practice works. The table below lists the common ones and the safe way to check each.

EOB means explanation of benefits, the statement an insurer sends after a claim. Real EOBs usually arrive by mail, as electronic remittances through your clearinghouse or in the payer's portal, so an EOB attachment from an unfamiliar sender deserves suspicion.

Owner mailbox takeover

The most damaging single event is a phished owner or office manager account, because those mailboxes hold years of patient correspondence. HHS's Office for Civil Rights (OCR) settled its first ever phishing investigation in December 2023 with Lafourche Medical Group, a Louisiana medical group. In March 2021 a phishing attack gave a hacker access to an email account that held electronic protected health information for about 34,862 people. The settlement was $480,000 with a corrective action plan monitored for two years, and OCR found the group had not conducted a risk analysis before the breach (HHS press release). Lafourche is a medical group, not a dental office, but the lesson is the same: one phished mailbox can hold a large amount of patient data.

Once inside, attackers often add a hidden rule that forwards or deletes mail, so they can keep watching after you change the password. Our guide to malicious inbox rules shows how to find them, and signs your email account is compromised lists the other clues.

Payment and payroll redirection

Business email compromise (BEC) is fraud where a criminal impersonates or takes over a trusted email account to redirect money. The FBI's IC3 recorded 24,768 BEC complaints in 2025, with $3,046,598,558 in reported losses across all industries (IC3 2025 report). In a dental office this usually looks like a lab or supply company "changing banks", or a staff member's direct deposit being switched. Here is an example of a message to stop and verify:

Example: "Hi Dana, we've moved our account to a new bank. Please update our details before you pay this month's lab invoice. The new ACH information is attached. Thanks, Accounts Receivable."

The FBI advises using "secondary channels and/or two-factor authentication to verify requests for changes in account information" (IC3 PSA I-091124-PSA). For the call-back routine, see vendor invoice fraud and payroll diversion scams.

What does HHS recommend for email in small practices?

HHS's 405(d) program recommends that small healthcare organizations configure their email system securely, train staff and run phishing simulations. Its Technical Volume 1 (2023 edition), written for small organizations without dedicated IT staff, includes these points:

• Avoid free email. It says small organizations "should avoid 'free' or 'consumer' email systems", because they may not have safeguards that meet the HIPAA Security Rule.
• Tag external mail. It suggests a tag such as "Stop. Read. Think. This is an External Email." on messages from outside.
• MFA first. It says to "deploy multi-factor authentication (MFA) before enabling access to your email system", for both web and local client access. MFA means a second proof of identity, such as an app code or security key, on top of the password.
• Encryption for sensitive mail. It suggests an email encryption service or module so staff can send securely to outside recipients.
• Phishing simulations. It says to "consider conducting entire workforce phishing simulations on at least a monthly basis."

None of this requires new staff. Microsoft 365 and Google Workspace both support MFA, external tagging and encryption options. See email encryption types for business for what each kind protects.

How does HIPAA apply to a dental office's email?

HIPAA doesn't ban email, but it expects you to protect patient information in it. HHS says the Privacy Rule allows providers to communicate with patients by email if they apply reasonable safeguards, and that a patient may choose unencrypted email after being warned of the risk (HHS FAQ). For email, that comes down to:

• a written risk analysis that includes email (the step OCR found missing at Lafourche)
• access controls, such as unique logins per person and MFA
• a documented decision on encryption
• agreements with vendors that store or process patient email
• a plan for investigating a compromised mailbox

Our guide to HIPAA email security requirements explains each standard, business associate agreements and breach notification in detail. This guide isn't legal advice. Ask your compliance adviser or counsel how the rules apply to your practice.

Is Microsoft 365 or Google Workspace protection enough for a dental office?

For many small practices, the built-in filtering in Microsoft 365 or Google Workspace, set up properly, is a reasonable baseline. Both platforms filter spam and malware, and both let you turn on MFA, external sender warnings and stricter phishing policies. If you have never reviewed those settings, do that first. Our guides to Microsoft 365 preset security policies and Google Workspace advanced phishing and malware protection walk through them. For the general case, see do you need a spam filter with Microsoft 365?.

An MX-level filter in front of your mailbox adds a separate layer. MX-level filtering means your domain's MX records, which tell the internet where to deliver your mail, point to a filtering service that checks messages before they reach your mail platform. That's useful for a dental office when:

• staff without IT training keep receiving phishing that the built-in filter misses
• you want each person to manage their own quarantine through a digest email, instead of calling an IT contractor to release a held message
• you want to block risky attachment types, Office macros or mail from countries you never deal with, without writing mail flow rules
• you want mail held if your mail server is unreachable, rather than bounced

An MX-level filter doesn't replace MFA, training or your HIPAA risk analysis. If your mail carries patient information, settle the business associate agreement question with the filtering provider before you route mail through it. Our healthcare practices page explains how iBlockSpam handles that question and what it filters.

How do you stop criminals pretending to be your practice?

Publish SPF, DKIM and DMARC so that mail faking your exact domain fails authentication. SPF lists the servers allowed to send for your domain, DKIM adds a cryptographic signature to your mail, and DMARC tells receivers what to do with mail that fails both. A practice that sends reminders through its scheduling software must include that service, or the reminders will fail too. A DMARC record at enforcement looks like this example:

_dmarc.example-dental.com  TXT  "v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@example-dental.com"

Start with p=none, check the reports for your reminder and billing services, then move to quarantine and reject. Our DMARC from none to reject guide covers the steps, and authenticating third-party senders explains how to include scheduling and statement services.

DMARC can't stop lookalike domains such as example-dentall.com. Tell patients how you bill, and see what to do when customers are phished by a fake version of your company.

Dental practice email security checklist

1. Move off any free or personal email account to a business platform on your practice's domain.
2. Turn on MFA for every mailbox, starting with the owner, office manager and billing staff.
3. Give each team member their own login. Replace shared front-desk passwords with a shared mailbox that people open with their own account. See shared mailbox spam protection.
4. Turn on external sender tags and review your platform's anti-phishing and attachment settings.
5. Write down your payment change rule: no bank detail change for any lab, vendor or employee without a phone call to a known number.
6. Include email in your HIPAA risk analysis and record your decision on encryption.
7. Publish SPF, DKIM and DMARC, including every service that sends reminders or statements for you.
8. Check every mailbox for forwarding rules you didn't create.
9. Give staff one way to report a suspicious email, and run a short phishing refresher each quarter.
10. Know who to call if a mailbox is compromised: your IT contact, your compliance adviser and, for fraud, ic3.gov. Our after clicking a phishing link guide covers the first hour.

Next steps

• Run the free Email Health Check on your practice's domain to see your MX, SPF and DMARC setup.
• Read HIPAA email security requirements before you change how patient information moves by email.
• Send your payment change rule to your lab, suppliers and payroll provider this week.
• If you want a filtering layer that every staff member can manage from a digest email, see email protection for medical and dental practices. Pricing is per domain, so adding an associate or hygienist doesn't change the bill.

More threat guides are in our phishing and threats topic.