Microsoft 365 for a small practice: what Purview does and does not do.
Microsoft’s tooling is excellent at enterprise scale. For a 12-person practice it means licensing tiers, Purview policies and an admin who knows where everything is. Gateway gives you the outcome with none of that.
| Requirement | Microsoft 365 Business | + PXCMail Gateway |
|---|---|---|
| BAA | Yes (all Business plans) | Yes |
| Enforced TLS to external recipients | Connector configuration per destination domain | Default |
| Encrypted delivery to any recipient | Purview Message Encryption on Business Premium ($22) with manual sensitivity labels | Automatic, one-time code |
| PHI detection | Purview DLP on Premium; policies built by you | Healthcare templates |
| Per-message encryption audit | Message trace, limited retention | Full audit trail, exportable |
| Archive | Exchange Online Archiving add-on | Included |
| Setup effort | Hours with an admin | 15 minutes, on a call with us |
| Cost for 10 seats | Basic $60 – Premium $220/mo | Basic $60 + Gateway $60 = $120/mo |
Microsoft list prices as of October 2026; verify current pricing.
If you already have Business Premium
You can configure most of this inside Purview. Gateway is still worth it if you want healthcare templates, a human to set it up, a per-message audit trail for your auditor, and encrypted delivery that patients find easy. Many MSPs deploy Gateway on Premium tenants for exactly those reasons.
What Microsoft’s BAA covers
Microsoft offers a HIPAA Business Associate Agreement to its enterprise and business customers and describes which services are in scope on its HIPAA and HITECH page. The BAA makes Microsoft your business associate for PHI in those services, on every Business plan. It does not make a message encrypted on the way to a patient’s ISP mailbox: Exchange Online uses opportunistic TLS by default and falls back to plain text. It does not detect PHI, produce a per-message record of the encryption outcome, or write your auditor a letter. Microsoft’s own page is clear that customers are responsible for configuring the services to meet their obligations.
What configuring Purview actually takes
On Business Premium you can get a long way with Microsoft’s own tools. You would create sensitivity labels and a mail flow rule that applies Purview Message Encryption; build DLP policies with the right sensitive-information types and run them in simulation before enforcing; set up connectors per destination domain if you want TLS required; buy Exchange Online Archiving if you want an archive; teach staff what the Encrypt button does and when to press it; and review all of it when people or templates change. That is a day of a competent admin’s time to start and recurring hours after, and the result is a recipient experience that patients find harder than a one-time code. Gateway is the same outcome in about 15 minutes on a call, with healthcare templates instead of policies you write, and a per-message audit trail Purview does not keep.
What Gateway adds
- TLS required on every outbound message; encrypted delivery with a one-time code when the recipient cannot do TLS; S/MIME automatic when they publish a certificate.
- Detection packs by industry and five actions (deliver, encrypt, warn, hold, block), with test mode and versioning.
- A per-message audit record and exports; a quarterly compliance report; an annual safeguards letter; evidence packs.
- A one-year immutable archive on every plan, six or seven years on the add-on, independent of Exchange.
- Our BAA, or the Data Processing & Safeguards Addendum for CPA, legal and title firms, signed at signup.
A week at Ortiz CPA
Ortiz CPA is a nine-person tax firm on Microsoft 365 Business Basic with Drake and TaxDome; the same path applies to a medical practice on Microsoft with the Healthcare profile instead of Safeguards. On Monday a client emails a W-2 and a staff member replies with a draft return attached; the document fingerprint matches a 1040 and the reply goes out encrypted, opened with a one-time code. On Tuesday Daniel Ortiz sends an engagement letter to a client whose server does TLS; delivered, logged. On Wednesday a TaxDome notification goes through the same connector and inherits the policy. On Thursday a seasonal preparer tries to forward a client list to a personal address; the policy holds it. On Friday Daniel pulls the quarterly report for the WISP binder his PTIN renewal asked about (IRS Publication 5708). Business Basic stayed Business Basic.
Cost for a 10-person practice
| Option | Per month, 10 seats, billed yearly | What you have |
|---|---|---|
| Business Basic + Microsoft BAA | ~$60 | BAA, opportunistic TLS, 50 GB |
| Business Basic + Gateway | ~$60 + $60 = ~$120 | Above + enforced TLS, encrypted delivery, detection, 1-year archive, audit trail, our BAA |
| Business Basic + Gateway with 6-year archive | ~$60 + $90 = ~$150 | Above, with 6-year immutable retention (7-year for accounting at $9 too) |
| Business Premium (Purview) | ~$220 | Message encryption and DLP you configure; archive is an add-on; no per-message encryption audit |
Microsoft list prices as of October 2026; verify before you budget. Gateway’s $49 minimum per organization equals eight seats, so it does not change the math at 10.
By the numbers
- The Security Rule’s technical safeguards, including transmission security, are at 45 CFR 164.312. For CPA firms the parallel is the FTC Safeguards Rule’s encryption element, 16 CFR 314.4(c)(3).
- Encrypted PHI is not “unsecured,” so its loss is not a notifiable breach (HHS guidance). Opportunistic TLS leaves you unable to prove which messages were encrypted.
- The FBI’s IC3 recorded 21,442 BEC complaints and $2.77 billion in losses in 2024 (IC3 2024 report).
What the auditor or carrier asks
- “Is email encrypted in transit and at rest?”
- Microsoft alone: at rest yes, in transit when the other side offers TLS. With Gateway: TLS required, encrypted delivery otherwise, each message logged with its method.
- “Do you have DLP?”
- Microsoft alone: on Business Premium, if someone built the policies. With Gateway: industry packs on every plan, with test mode and a log of every decision.
- “Can you produce a year of email with chain of custody?”
- With Gateway: journaled archive, exports in EML, MBOX or PST with a sha256 manifest and a chain-of-custody statement. Microsoft alone: Exchange Online Archiving if you bought it, plus eDiscovery.
- “Who signed what?”
- Microsoft’s BAA for the mailbox; the PacinfraX BAA or Safeguards addendum for the encryption layer and archive. Both on file from day one.
Steps to add Gateway
- Start the trial; sign the BAA or addendum electronically. Nothing is charged for 14 days.
- Create the outbound connector in the Exchange admin center and a mail flow rule scoped to a pilot group; add the three DNS records. Setup guide
- Run the profile in test mode; read the log with whoever owns compliance.
- Widen the rule to everyone and switch to enforce.
Questions practices and firms ask
I already pay for Business Premium. Is Gateway redundant?
Not if you want healthcare or Safeguards templates, a per-message audit trail, a one-time-code recipient experience and a human to set it up. If you have the admin hours and only need encryption, Purview may be enough; we would rather you know that than buy twice.
Does Gateway interfere with Purview labels or Defender?
No. Gateway sees mail after Exchange has applied your rules. Messages Purview already encrypted pass through as they are. Keep Defender’s inbound filtering; Gateway is outbound unless you route MX to us.
What do recipients see?
TLS recipients see a normal email. Others get a notification and open with a one-time code by SMS or email; no account, 30-day expiry, every open logged. Sign-in with Microsoft, Google or Apple is ROADMAP.
Is there an Outlook add-in?
ROADMAP. Today [SECURE] in the subject forces encryption, and detection packs handle most cases without it.
What if PXCMail is down?
Exchange queues outbound mail and retries. We run in AWS us-east-1 with us-west-2 for disaster recovery, publish a 99.9% SLA, and respond to P1 incidents within 30 minutes. Status