Get Started

EMAIL SECURITY AND HIPAA COMPLIANCE FOR MEDICAL AND DENTAL PRACTICES

DMARC for Healthcare: Stop Scammers From Emailing Your Patients as You

Patients open email from their doctor’s office without a second thought. Scammers count on that. We lock down your practice’s email so only you can send as you, and we help you document the HIPAA safeguards you’re required to have.
Check My Domain Free
Get a Quote
  • Maryland SBR Certified
  • SAM.gov Registered
  • CompTIA Security+ Certified
  • We Sign a BAA

Why practices choose ObaShield

Is your practice at risk? If any of these sound familiar, run the free scan. It takes about 60 seconds.

  • Patients have asked about emails or bills you didn't send
  • Appointment reminders or portal emails land in spam
  • No one has ever set up email protection on your domain
  • You're not sure which systems send email for you
  • You haven't done a HIPAA risk assessment in the last year
Healthcare worker using laptop featuring DMARC for healthcare email security | Oba Shield

THE PROBLEM

Why healthcare email is a target

Few senders get more trust than a patient’s doctor. An email from your practice gets opened, and the link inside gets clicked. If your domain isn’t protected, anyone can send email that looks like it came from you. No hacking required.

It’s expensive when it works. Business email fraud cost $2.77 billion in reported losses in 2024, according to the FBI’s Internet Crime Complaint Center. (Link: FBI IC3 2024 report)

Fake patient bills

Payment requests that look like they came from your front desk.

Fake lab result links

"Your results are ready" emails that lead to fake login pages.

Invoice fraud

Fake vendor emails asking your staff to pay or change bank details.

Real email in spam

Gmail, Yahoo and Outlook now check whether your email can be trusted. Unprotected domains see reminders and billing emails land in junk.

HOW WE HELP

Two ways we protect your practice

Email Security

We set up DMARC, SPF and DKIM so no one can send email as your practice, then watch it every month.

See Email Security

HIPAA Security Risk Assessment

The written risk assessment every practice is required to have, done for you and delivered as a report you can file.

See Risk Assessment
Many practices start with both. The risk assessment finds the gaps, email security closes one of the most common ones, and we can handle the rest (see “We fix what we find”).

EMAIL SECURITY

Healthcare email security, handled for you

We set it up, keep an eye on it, and explain what we found in plain English. Your staff never has to touch a DNS record.

DMARC, SPF and DKIM setup

We find every system that sends email for your practice (EHR, patient portal, billing, reminders) and set up email authentication so your real email gets through and fakes get blocked.

Monthly monitoring and reports

Every month we review who sent email in your name and send a plain-English summary of what we found and fixed. See a sample report.

Step-by-step enforcement

We tighten protection in stages, from watching to blocking, so appointment reminders and patient emails never get caught in the crossfire.

Microsoft 365 and Google Workspace hardening

We tighten your email platform's settings and turn on multi-factor login, so a stolen password isn't enough to get in.

Cyber insurance readiness

Insurers now ask about multi-factor login and email authentication. We close those gaps and give you documentation for your application.

Encrypted email and inbox protection

Send patient information securely with encrypted email, and stop phishing, malware and data leaks before they reach your staff's inboxes.

Staff phishing training

Phishing simulations and short training, delivered through our training partner, so your team can spot fake emails before they click.

How it works

1. Free scan

Enter your domain on our free email security scan and see where you stand in about 60 seconds.

2. Quick call

We walk through the results and list every service that sends email for your practice.

3. Setup

We fix your records and start in monitoring mode, so nothing breaks.

4. Monitor and tighten

We fix anything that's failing, then switch on full blocking once your real email passes.

5. Monthly report

A plain-English summary every month that you can keep with your HIPAA documentation.

What you get

During setup

a review of every system that sends email in your name, correct SPF, DKIM and DMARC records, and a step-by-step move to full protection with no email downtime.

Every month

a one-page report on your domain, a list of anyone who tried to send email as you, and any fixes we made.

Your time

about 30 minutes for a kickoff call. We handle the rest.

Email security packages

Small Practice

1 to 5 providers, one location

DMARC, SPF and DKIM setup; review of every system that sends your email; step-by-step move to full protection; monthly report

Get Started
Get a quote
★ Most Popular

Mid-Size Practice

6 to 15 providers, one location
Everything in Small Practice; Microsoft 365 or Google Workspace hardening; multi-factor login review; staff phishing training through our partner
Get Started
Get a quote

Multi-Location or Multiple Domains

Several locations, brands or domains
Everything in Mid-Size; protection for every domain you own; reporting by location; scope confirmed in writing before work starts
Get Started
Get a quote
One flat price, quoted up front. No hourly billing.

HIPAA COMPLIANCE

HIPAA Security Risk Assessments, done for you

If your practice handles electronic patient records, HIPAA requires a written Security Risk Assessment. Many small practices have never done one, or did it years ago and never updated it. Our certified consultants handle the whole process and hand you a report you can file.

Required by law

Under 45 CFR 164.308(a)(1)(ii)(A), for every covered entity and business associate.

A top enforcement focus

HHS's Office for Civil Rights has made missing or incomplete risk analyses a priority in its investigations.

Not one and done.

Review it regularly and whenever your systems, staff or locations change. Most practices update it every year.

HIPAA COMPLIANCE

HIPAA Security Risk Assessments, done for you

If your practice handles electronic patient records, HIPAA requires a written Security Risk Assessment. Many small practices have never done one, or did it years ago and never updated it. Our certified consultants handle the whole process and hand you a report you can file.

Required by law

Under 45 CFR 164.308(a)(1)(ii)(A), for every covered entity and business associate.

A top enforcement focus

HHS's Office for Civil Rights has made missing or incomplete risk analyses a priority in its investigations.

Not one and done.

Review it regularly and whenever your systems, staff or locations change. Most practices update it every year.

What we review

Administrative:

security officer, policies, staff training, access management, incident response, backup and recovery plans, vendor agreements

Physical:

office and server room access, workstations, laptops and phones, device disposal

Technical:

logins and multi-factor authentication, automatic logoff, encryption, audit logs, EHR access settings, email security, backup testing

What you receive

Written Security Risk Assessment covering all three areas, with each risk's likelihood and impact

Patient data inventory of every system and device that holds patient information

Risk register ranked by priority, so you know what to fix first

Remediation plan in plain English, written for practice owners, not IT staff

Free email security check of your domain

60-minute debrief call to walk through every finding

30-day follow-up to review progress on high-priority items

Risk assessment packages

Small Practice

1 to 5 providers, one location
Everything listed under “What you receive”
Get Started
Get a quote
★ Most Popular

Mid-Size Practice

6 to 15 providers, one location
Everything in Small Practice; more staff interviews; access review by role; patient data flow mapping; vendor BAA review
Get Started
Get a quote

Multi-Location or Complex

Several locations or a complex IT setup
Everything in Mid-Size; inventory for each location; site-by-site findings; scope confirmed in writing before work starts
Get Started
Get a quote

Most assessment firms hand you a report and walk away. We can also fix what we find, from email security and Microsoft 365 hardening to replacing outdated hardware.

Get a Risk Assessment Quote

BEYOND THE REPORT

We fix what we find

A risk assessment shows you the gaps. We close them, with one team and one plan, so you’re not hiring five different vendors.

24/7 threat monitoring

Around-the-clock monitoring of your computers, email and accounts, with a response team ready to act the moment something looks wrong.

Encrypted email for patient information

Send patient information securely and keep phishing and malware out of your staff's inboxes.

Endpoint protection

Modern protection on every computer and laptop that stops ransomware and malware before it spreads.

Backup and recovery

Automatic, encrypted backups of your systems and data, tested so you can get back up and running fast. Covers HIPAA's contingency plan requirement.

Cyber insurance readiness

Insurers now ask about multi-factor login and email authentication. We close those gaps and give you documentation for your application.

Patching and device management

Keep every computer updated and accounted for, without your staff having to remember.

Firewalls and secure Wi-Fi

Business-grade firewalls and networks that keep patient data separate from guest Wi-Fi.

Microsoft 365 setup and security

Licensing, setup and security settings for Microsoft 365, including multi-factor login for every account.

Vulnerability scanning

Regular scans that find weak spots in your network before attackers do.

Cyber insurance readiness

We work with insurance brokers to close the gaps that get practices declined or surcharged, then document the fixes for your application. (Link this card to Section 5C.)

Talk to Us About Your Gaps
CYBER INSURANCE

Get insurance-ready before your application or your next renewal

Insurers now check for specific security controls before they write or renew a policy. Missing one can mean a decline, a surcharge, or a claim that gets denied later. We find the gaps and close them.

The three checks insurers ask about first

Check 1: Multi-factor login on everything that matters

Email, every user and mailbox Required
Remote access, VPN and remote desktop Required
Admin accounts, anyone who can change settings Required

A password plus a code or tap on your phone. It's the first question on almost every application, and partial setup counts as a no.

Check 2: Real protection on every device

Front desk PC, basic antivirus only Not enough
Owner's laptop, updates 3 months behind At risk
Office server, modern threat detection Protected

Insurers want modern threat detection, called EDR, on every computer and server, plus security updates installed on time. Old-school antivirus alone often isn't enough anymore.

Check 3: Backups you can actually restore

Automatic daily backups Yes
A separate, locked copy ransomware can't reach Yes
Restore tested on a schedule Yes

If ransomware hits, backups decide whether you're down for a day or for weeks. Insurers want proof they're separate, protected and tested.

How we get you insurance-ready

1

Readiness check.

We compare your setup to what insurers ask.

2

Close the gaps.

We set up the missing controls for you.

3

Proof on paper.

Documentation so you can answer the application honestly.

Insurance brokers: have clients getting declined or surcharged? Send them our way. We fix the security gaps, you place the policy.

Book a Readiness Check

ObaShield is not an insurance company. Coverage decisions are made by insurers.

Built for practices without an IT department

  • Done for you. We handle the setup, the paperwork and the follow-up.
  • Plain English. Reports and recommendations written for practice owners, not IT people.
  • We sign a BAA. A Business Associate Agreement is in place before any work begins.
  • We fix what we find. Email security, Microsoft 365, multi-factor login and hardware, all from one team.
  • Local and certified. A Maryland SBR certified small business in North Bethesda, with a CompTIA Security+ certified team.
  • A real person answers. Call 301-500-0211 and talk to the people doing the work.
We work with medical practices, dental offices, specialty clinics and behavioral health providers across Maryland, Washington DC and Northern Virginia, including Rockville, Bethesda, Silver Spring, Gaithersburg, Columbia and Baltimore. Email security is done remotely, so we can help practices anywhere in the US.

Free HIPAA Email Security Checklist

Not ready to talk yet? Grab our one-page checklist of the 10 email safeguards every practice should have in place, in plain English.

Healthcare email security questions

What is DMARC, and does my practice need it?

DMARC is a setting on your domain that tells inboxes what to do with email that pretends to be you. If your practice emails patients from its own domain, you need it. We explain it in detail in What Is DMARC and Does My Medical Practice Need It?

SPF lists who can send for you, DKIM signs your email so it can’t be altered, and DMARC enforces both. Read SPF, DKIM, and DMARC: What’s the Difference and Why You Need All Three.
No. We start in monitoring mode, find every service that sends email for you, and only switch on blocking once your real email passes
Yes. We sign a Business Associate Agreement with healthcare clients before any work begins.
Setup usually takes a few days. Moving safely to full enforcement takes a few weeks, depending on how many systems send email for you.
Yes. Many insurers now ask about multi-factor login and email authentication (SPF, DKIM and DMARC) on applications and renewals. We set these up and give you documentation, so you can answer those questions accurately.
Yes. Many insurers now ask about multi-factor login and email authentication (SPF, DKIM and DMARC) on applications and renewals. We set these up and give you documentation, so you can answer those questions accurately.
Yes. Many insurers now ask about multi-factor login and email authentication (SPF, DKIM and DMARC) on applications and renewals. We set these up and give you documentation, so you can answer those questions accurately.
Yes. Many insurers now ask about multi-factor login and email authentication (SPF, DKIM and DMARC) on applications and renewals. We set these up and give you documentation, so you can answer those questions accurately.
What is DMARC, and does my practice need it?

DMARC is a setting on your domain that tells inboxes what to do with email that pretends to be you. If your practice emails patients from its own domain, you need it. We explain it in detail in What Is DMARC and Does My Medical Practice Need It?

SPF lists who can send for you, DKIM signs your email so it can’t be altered, and DMARC enforces both. Read SPF, DKIM, and DMARC: What’s the Difference and Why You Need All Three.
No. We start in monitoring mode, find every service that sends email for you, and only switch on blocking once your real email passes
Yes. We sign a Business Associate Agreement with healthcare clients before any work begins.
Setup usually takes a few days. Moving safely to full enforcement takes a few weeks, depending on how many systems send email for you.

Yes. Insurers now ask about email protection and multi-factor login before they write a policy. We set these up and document them, so you can answer the application honestly.

See where your practice stands in 60 seconds

Run our free email security scan. No signup and no sales pitch, just a clear picture of your email protection.
Check My Domain Free
Get a Quote
Questions? Call 301-500-0211 or email info@obashield.com

Tell us about your practice

Takes about 3 minutes. We reply within 1 business day with next steps. Your information is never sold or shared.

Resources

HEALTHCARE EMAIL SECURITY

DMARC for Healthcare: Stop Scammers From Emailing Your Patients as You

Patients trust email from their doctor’s office. We make sure every email using your practice’s name actually came from you, with DMARC, SPF and DKIM set up correctly and watched every month.
Check My Domain Free
Talk to Us

THE PROBLEM

Why healthcare email is a target

Scammers go where people already trust the sender, and few senders are trusted more than a patient’s doctor. An email from your practice gets opened. A link in it gets clicked.

Without email authentication, anyone can send messages that look like they came from your domain. Patients get fake bills. Staff get fake invoices from “vendors.” Insurers and referring offices get messages that never came from you.

It’s expensive when it works. Business email fraud cost $2.77 billion in reported losses in 2024, according to the FBI’s Internet Crime Complaint Center.

Fake patient billing

Spoofed payment requests that look like they came from your front desk.

Credential theft

“Your lab results are ready” emails that lead to fake login pages.

Invoice fraud

Spoofed vendor or partner emails asking your staff to pay or change bank details.

DMARC closes that gap. Once it’s fully in place, it tells Gmail, Outlook and other inboxes to reject email that pretends to be you, and it shows you exactly who is sending in your name.

What we do

Healthcare email security solutions, handled for you

We set it up, watch it, and tell you in plain English what we found. Your staff doesn’t need to learn DNS records.

DMARC, SPF and DKIM setup

We find every system that sends email for your practice (EHR, patient portal, billing, reminders) and set up email authentication for healthcare so your real email passes and fakes get blocked.

Monthly monitoring and reports

We review your DMARC reports every month and send a plain-English summary of who sent email as you and what we fixed. See a sample report.

Step-by-step enforcement

We move your domain from monitoring to quarantine to reject, carefully, so appointment reminders and patient emails never get caught in the crossfire.

Microsoft 365 and Google Workspace hardening

We tighten the settings on your email platform and turn on multi-factor authentication, so a stolen password isn't enough to get in.

HIPAA email security without the jargon

HIPAA doesn’t name DMARC, but the Security Rule does require you to protect patient information and reduce the risks to it. Email impersonation is one of the most common ways attackers get in.

Email authentication is a simple, documented safeguard. Our monthly reports give you a written record that your domain is protected, which is useful for your risk analysis and for showing you took reasonable steps.

Built for practices without an IT department

We work with independent medical practices, dental offices, specialty clinics, behavioral health providers and other healthcare organizations across Maryland, Washington DC and Northern Virginia. Email security work is done remotely, so we can help practices anywhere in the US.

How it works

From free scan to full protection

01

Free scan

Enter your domain on our free email security scan and see where your SPF, DKIM and DMARC stand in seconds.

02

Quick call

We walk through the results and list every service that sends email for your practice.

03

Setup

We fix your records and start DMARC in monitoring mode, so nothing breaks.

04

Monitor and tighten

We review the reports, fix what's failing, and move your policy to reject once your real email passes.

05

Monthly report

You get a plain-English summary every month, ready for your HIPAA documentation.

Start With a Free Scan