Email protection for medical and dental practices

A medical or dental practice needs email filtering that stops phishing, spoofed senders and malware before staff open them, plus a clear view of what the HIPAA Security Rule expects. iBlockSpam filters inbound mail at the MX level, in front of the platform you already use, for one price per domain. This page explains where filtering helps and where it doesn't.

Why practices are targeted by email

Practices hold what criminals want: patient records, billing data and access to the systems that run the practice. They also run on email. Referrals, lab results, billing questions and vendor notices all arrive in the same inboxes, often read quickly between patients.

The HHS 405(d) program publishes Health Industry Cybersecurity Practices (HICP), guidance that examines the cybersecurity threats affecting healthcare, and email phishing is one of them. Its email phishing flyer notes that phishing can expose patients' names, dates of birth, medical record numbers and Social Security numbers. It also describes a typical attack: staff receive a message that looks like it's from IT support at the practice's patient billing company, asking them to change their billing software password. The link leads to a fake sign-in page. With those credentials, the attacker can reach financial and patient data (HHS 405(d): Email Phishing Attacks).

Ransomware is the other serious risk. The FBI's Internet Crime Complaint Center (IC3) says the 10 ransomware variants most reported to it in 2025 most affected three critical infrastructure sectors, one of which was Healthcare and Public Health (IC3 2025 Internet Crime Report). Email is a common way in. CISA, the NSA, the FBI and MS-ISAC describe malware-based phishing as malicious links or attachments that download malware and give attackers initial access (CISA: Phishing Guidance, Stopping the Attack Cycle at Phase One).

Common attacks on practices

• Vendor and IT impersonation. Fake password resets, "billing system" notices and shared-document alerts that lead to credential-stealing pages.
• Lookalike senders. The 405(d) flyer warns that an address can be identical except for one letter, such as "qmail" instead of "gmail." See our guide to lookalike domain phishing.
• Malicious attachments. "Referral forms", invoices and "lab results" that carry macros or executables. CISA recommends blocking risky file extensions at the email gateway and blocking macros by default.
• Payment and payroll redirection. Requests to change a vendor's bank details or an employee's direct deposit. Our business email compromise guide covers the verification steps.

What the HIPAA Security Rule says about email

This section summarizes the regulation text. It isn't legal advice, and iBlockSpam doesn't make any practice compliant with HIPAA.

The Security Rule requires covered entities and business associates to ensure the confidentiality, integrity and availability of the electronic protected health information (ePHI) they create, receive, maintain or transmit, and to protect against reasonably anticipated threats to it (45 CFR 164.306). It's flexible by design: you choose measures based on your size, complexity, technical setup, costs, and the probability and criticality of the risks.

Several provisions touch email directly:

"Addressable" doesn't mean optional. Under 164.306(d), you assess whether each addressable specification is reasonable and appropriate. If it isn't, you document why and implement an equivalent alternative where reasonable.

For your own domain, NIST's guidance on trustworthy email recommends publishing SPF and a DMARC record, and using STARTTLS between mail servers where it's offered (NIST SP 800-177 Rev. 1). Those records make it harder for criminals to send mail that appears to come from your practice. Our STARTTLS guide explains what TLS between servers does and doesn't protect.

What iBlockSpam does for a practice

Filtering before mail reaches your staff

Your MX records point to our filtering servers. Inbound mail is checked for spam, viruses, malware, phishing and spoofing, and clean mail goes on to Microsoft 365, Google Workspace, Exchange Server or your hosted server. Advanced settings add:

• Attachment-type filters to hold or block risky file types.
• A Microsoft Office macro filter for documents that carry macros.
• Geographic filters and custom domain rules for patterns specific to your practice.

A quarantine the front desk can use

Every user gets a personal quarantine and a digest email hourly, daily, on a chosen weekday or on a custom schedule. A receptionist waiting for a referral can find and release it without calling IT. An administrator can review the shared quarantine for the whole domain. Approved and blocked sender lists can require sender verification, so a spoofed message claiming to be from an approved lab or vendor still gets checked. See quarantine and digests.

Records and resilience

You can search 30 days of message history. If your mail server is down, mail is held for up to 5 days and then delivered; see outage spooling. Domain monitoring alerts you when your MX, SPF or DMARC records change: weekly on Protect, daily on Protect Plus.

Your own domain's authentication

Free tools check what you publish today: the SPF Checker, DMARC Checker and DKIM Checker. If you send from a scheduling system or a server of your own, our outbound relay signs mail with DKIM; 500 relay messages a month are included. DMARC monitoring is included with every plan: point your reports at us to see who sends as your domain.

What iBlockSpam does not do, and questions to ask

We'd rather you hear the limits from us than find them in a review.

• We don't claim HIPAA compliance, and we hold no SOC 2 or ISO certification.
• Business associate agreements: ask us whether we can sign one for your setup before you route patient email through iBlockSpam. Under 45 CFR 164.308(b), a covered entity may let a business associate create, receive, maintain or transmit ePHI on its behalf only with satisfactory assurances, documented in a written contract or other arrangement. Your compliance adviser can tell you how that applies to your vendors.
• We filter inbound mail. iBlockSpam doesn't encrypt the messages your staff send to patients, replace multi-factor authentication or train your team.
• No filter catches everything. A message from a vendor's real, compromised mailbox can pass every check. Verify payment and account changes by phone, using a number you already have.
• Data handling: mail is processed in the United States, and message history is kept for 30 days. Our security page describes how mail is handled, so you can assess it against your own obligations.

Questions worth asking any email security provider, including us:

1. Will you sign a business associate agreement for our setup, and what does it cover?
2. Where is our mail processed, and how long are messages and logs kept?
3. Who on your side can see quarantined messages, and when?
4. How is mail protected in transit between your servers and ours?
5. What happens to our mail if our server is down, and for how long?
6. Can staff release their own held mail, and can we see everything as administrators?
7. How do we leave, and how quickly can we point our MX records back?

Getting set up

Setup is an MX change plus a few platform-specific steps, guided by our setup wizard. It shows a before/after DNS comparison and the rollback steps for your domain.

1. Ask your BAA question first, then check your domain with the free Email Health Check. It reads public DNS only.
2. Add your practice's domain and point it at the mail platform you use today.
3. Follow the platform steps, for example a Partner connector with Enhanced Filtering for Connectors in Microsoft 365, or an inbound gateway in Google Workspace.
4. Send test messages and watch the first digests arrive before you tell the whole practice.

Most domains are set up in one session. That's our aim, not a promise, because DNS and platform settings vary. On Protect Plus, a person from our team runs the setup session with you.

Priced per domain, not per clinician

Protect is $12 per domain per month billed annually ($144/year), or $15 month-to-month. Protect Plus is $19 per domain per month billed annually ($228/year), or $24 month-to-month. Both include unlimited mailboxes (a count of mailboxes, not unlimited message volume) and 100,000 inbound messages per domain per month. Prices are beta pricing in USD, excluding tax. Adding a hygienist or a locum doesn't change your bill. Compare the models in per-domain vs per-user pricing.

To start, run the free Email Health Check on your practice's domain, then create your account.

Sources

• HHS 405(d): Health Industry Cybersecurity Practices, Email Phishing Attacks
• FBI IC3: 2025 Internet Crime Report
• CISA, NSA, FBI and MS-ISAC: Phishing Guidance, Stopping the Attack Cycle at Phase One
• 45 CFR 164.306: Security standards, general rules (eCFR)
• 45 CFR 164.308: Administrative safeguards (eCFR)
• 45 CFR 164.312: Technical safeguards (eCFR)
• NIST SP 800-177 Rev. 1: Trustworthy Email