Turnkey Paubox, Virtru, or Microsoft Purview on your existing M365 or Google tenant — DLP rules tuned to Dentrix, Eaglesoft, Open Dental, Curve, and Carestream. BAA signed before kickoff.
PHI leaves in the clear. §164.312(e)(1) gap.
Auto-encrypted. Portal-free. Audit-ready.
Your PMS isn’t the problem. The hand-off is. The moment your team emails a Dentrix treatment plan, an Eaglesoft x-ray export, or a statement PDF to a patient’s Gmail, Yahoo, or AOL inbox, you’re relying on your email provider’s server-to-server TLS to negotiate encryption with their provider. That negotiation fails about one-third of the time with consumer mail, and when it fails your PHI leaves in the clear. Neither you nor the patient gets a warning.
That’s the §164.312(e)(1) gap OCR has been citing since 2024. Westend Dental paid $350K. Gums Dental paid $80K. Four single-location dental practices paid more than $100K each. All small. All email-triggered.
We audit current tenant, pull mail-flow routing, interview practice manager. Output: 1-page current-state report with 3-5 specific gaps.
We provision Paubox/Virtru/LuxSci. DLP rules live. Top-10 consumer mail test runs. Staff training scheduled.
§164.312(e)(1) written policy delivered. BAA chain signed. Post-deploy monitoring on. Auditor-ready.
Covered entities must “implement technical security measures to guard against unauthorized access to ePHI being transmitted.” OCR has been citing this specifically since Q1 2024. HHS.gov primary source →
If a vendor touches your PHI, you need a BAA. Paubox, Virtru, and LuxSci all execute BAAs. Consumer Gmail does not. See our HIPAA compliance engagement for the full BAA chain we build for every dental client.
Applies to dental practices offering third-party financing (CareCredit, LendingClub). Encryption mandatory June 2023. Our build satisfies both HIPAA and Safeguards in one pass. FTC Safeguards Rule →
| Paubox Plus | Virtru | Microsoft Purview | Google Confidential Mode | |
|---|---|---|---|---|
| HIPAA-sufficient alone | Yes | Yes | Yes (configured) | No |
| BAA included | Yes | Yes | Yes (with M365 plan) | No |
| Patient UX | Portal-free — opens in any inbox | Portal for non-Virtru recipients | Native Outlook, portal external | “View email” click, expires |
| DLP auto-encrypt | Advanced, dental-tuned | Strong, rule-based | Strong, Business Premium req | Basic, keyword-only |
| Deploy time (our build) | 15-30 min tenant-side | 30-60 min | 2-4 hr | N/A — skip |
| Typical monthly (6 mailboxes) | $99-150/mo | $140-180/mo | Included in Biz Premium | Included but insufficient |
| Best for | Our default | Google-heavy practices | M365 Biz Premium + budget-tight | Skip. Fallback only. |
Shipping email-security layers for managed-IT clients since 2022 — healthcare, hospitality, professional services. We’re a dental-specialist MSP by vertical focus.
Public record via HHS OCR Breach Portal.
For many practices yes — if you’re on Business Premium plus DLP tuned to your PMS. Most aren’t. Purview out-of-box gives the crypto but not dental-specific triggers. 60% of practices we assess end up with a Paubox or Virtru layer on top.
Not with Paubox. Paubox delivers to any inbox (Gmail, Yahoo, AOL, iCloud) with zero portal, zero password. Virtru requires one-time auth. Purview/Google Confidential use portal/”view message” that patients call about. Patient UX is why we default to Paubox.
Your PMS stays where it is. Encryption layer sits on your M365/Google tenant, intercepts outbound mail. When a Dentrix treatment plan lands in Sent folder en route to patient, DLP sees attachment, classifies as PHI, auto-encrypts. No workflow change for your team.
That’s why the top-10 consumer-mail test is in the bundle. We send PHI-shaped tests to Gmail, Yahoo, Outlook.com, iCloud, AOL, and 5 regional ISPs before handoff. If anything breaks, we fix it.
2024-2025 OCR trends say yes. Westend (Indiana, single location, $350K), Gums (NJ, $80K), 4+ single-location practices with $100K+ settlements. Smaller practices often have thinner documentation, which makes OCR’s job easier. Risk Analysis Initiative issued 7 enforcement actions in 6 months — median practice size under 3 locations.
Probably — question is whether you want to. We deliver in 2-3 weeks with audit-ready docs. Generalist IT typically runs 6-12 weeks because they’re learning dental workflow. Our flat-rate is priced against a 2-3 week build. If you have a dental-specialist MSP, by all means — they should do this. If not, we’re built for it.
Starts at $149/mo recurring plus $1,500 one-time deployment for a typical 1-location, 6-mailbox practice. Over 6 mailboxes quoted per-user ($25-30/user/mo). Deployment flat regardless of size. BAA executed before kickoff. 15-min call locks exact quote.
Starting at $149/mo per practice · $1,500 one-time deployment
Flat recurring for practices up to 6 mailboxes. 7+ mailboxes quoted per-user at $25-30/user/mo. Deployment flat regardless of size. BAA-signing MSP. Month-to-month after month 6.
Your exact quote depends on your PMS, your email tenant (M365 or Google), and your third-party layer choice (Paubox, Virtru, or LuxSci). The 15-min call decides it. No PHI required to book.
Or grab the vendor comparison PDF first. See also: our cybersecurity services · contact page.