Treatment plans, X-rays and referrals, sent the right way every time.
Dental offices send more PHI by email than most medical practices: estimates, radiographs, specialist referrals, insurance pre-authorizations. PXCMail makes the safe way the default for everyone at the front desk.
| Time | Message | Delivery |
|---|---|---|
| 09:14 | Oral surgery referral · CBCT | TLS ✓ · S/MIME |
| 09:40 | Delta Dental pre-auth 48-2211 | TLS ✓ |
| 10:02 | Treatment plan → patient (gmail) | 🔒 Encrypted · opened |
| 10:15 | Patient list → personal mailbox | Blocked · policy |
Overview
Front desk
Shared frontdesk@ and insurance@ mailboxes; the whole team sees what was sent and whether it was opened.
Referrals
Specialists and labs that publish S/MIME certificates get encrypted automatically; others get one-time-code delivery. Large files (radiographs, CBCT) supported.
Multi-location groups
One policy, one BAA, one audit trail across locations; per-location admins. IT providers get a partner console.
Practice management software
PXCMail works beside Dentrix, Eaglesoft, Open Dental and Curve: anything they email on your behalf can route through Gateway with the same policy as your staff.
Insurance and pre-authorizations
Insurance IDs and dates of birth trigger encryption automatically. Replies from payers come back on the record.
Price for a 12-person office
Gateway on your existing Google or Microsoft account: $72/month. Full Hosted mailboxes: $144/month. Both include the BAA, encryption, PHI detection and audit. Pricing →
What HIPAA actually asks of a dental office’s email
HIPAA does not ban email. It requires that electronic PHI be protected in transit and at rest (45 CFR 164.312), that someone in the office owns the risk analysis and the written policy (164.308), and that the policies and the records of what happened be kept six years (164.316). For a dental office that comes down to three things: encryption that turns on by itself when a message carries PHI, a log that shows each treatment plan and referral was sent and opened, and a BAA with whoever handles the mail. PXCMail does those three on the Google Workspace or Microsoft 365 account you already have. It does not replace Dentrix, Eaglesoft or Open Dental, and it does not certify you; there is no HIPAA certification for anyone to hold.
A week at Lakeside Family Dental
Lakeside is a 12-person office on Google Workspace with Dentrix. The office manager owns the HIPAA binder; nobody there is an IT person.
- Monday. The front desk sends 14 treatment-plan estimates from
frontdesk@. Each has a patient name, date of birth and insurance ID, so the healthcare detection pack marks them PHI and they go out as locked delivery. Patients open on their phones with a one-time code; every open is logged. - Tuesday. A hygienist emails bitewings and a CBCT to the oral surgeon. The surgeon’s practice publishes an S/MIME certificate, so the message is encrypted end to end with nothing to click. The 180 MB scan goes through locked delivery, which carries attachments up to 2 GB.
- Wednesday.
insurance@sends a Delta Dental pre-authorization with a member ID. Policy: encrypt. The payer’s reply comes back on the record. - Thursday. A new assistant tries to forward the day’s schedule to her personal Gmail. Policy: block. The message bounces to her with a one-line explanation and the office manager gets a notice. Nothing left the building.
- Friday. The office manager opens the console: messages scanned, encrypted, blocked, opened. The quarterly report goes in the binder next to the risk analysis.
By the numbers
- 98% of cyber insurance claims in the NetDiligence 2025 study came from small and mid-sized businesses, not large ones. (NetDiligence Cyber Claims Study 2025)
- 60 days is the outer limit for notifying patients after a breach of unsecured PHI; breaches affecting 500 or more people also go to HHS and the media. (45 CFR Part 164, Subpart D) PHI that was encrypted to HHS’s standard is not “unsecured”, which is why automatic encryption matters more than any policy memo. (HHS guidance)
- 6 years is how long HIPAA documentation and the records of your actions must be kept. (45 CFR 164.316) Settlements with HHS are a tail risk, not the everyday one; the public list is on the HHS resolution agreements page.
What the auditor asks
“Is PHI encrypted when it leaves the office?” Always. TLS is required to every recipient; messages the detection pack marks as PHI go by S/MIME or locked delivery. The per-message record shows which method was used.
“Who has a BAA with you for email?” PXCMail, signed electronically at signup. Google’s or Microsoft’s own BAA still covers the mailbox; ours covers what passes through the Gateway and the archive.
“Show me who sent what to whom last March.” Archive search by sender, recipient, date or patient name; export as EML or PST with a sha256 manifest.
“What happens when someone leaves?” Offboarding revokes access in the console; the mailbox and its archive stay under the six-year retention. The audit log shows the date.
“Where are the policies?” Every policy change is versioned in the console and appears in the audit trail; the annual safeguards letter summarises the controls for the risk-analysis file.
Going live at a dental office
- Sign up and sign the BAA
14-day trial, card or PayPal on file, nothing charged. Pick the healthcare profile; the BAA is part of signup. - Connect Google Workspace or Microsoft 365
The DNS wizard re-checks every five minutes; most offices finish on one support call. - Run the policy in test mode for a week
See what would have been encrypted or blocked before anything changes for staff. Addfrontdesk@andinsurance@as shared mailboxes. - Route Dentrix or your practice software through Gateway
Anything it emails on your behalf inherits the same policy. Then switch from test mode to enforce.
What Lakeside pays
- Gateway, 12 seats
- $72 per month, billed yearly
- Gateway + 6-year archive
- $108 per month ($9 per seat)
- Hosted mailboxes, 12 seats
- $144 per month; migration from Google is free up to 50 seats
- Hosted Pro
- $216 per month, with legal hold, SSO and a contractual SLA
Every tier includes the BAA, PHI detection, locked delivery and the audit trail. The organization minimum is $49, so a four-person office pays the same as eight Gateway seats.
Questions dental offices ask
Do patients need an account or an app to read an encrypted treatment plan?
No. They get a notification, open the message with a one-time code sent by SMS or email, and can reply securely from the same page. Links expire after 30 days by default (1 to 90 configurable) and can be revoked.
Can a patient ask for plain email instead?
Yes. HHS says providers may communicate by email when the patient asks for it after being told of the risk. Document the request, then exempt the address in policy; the exemption itself is logged.
We have three locations on two Google tenants. One policy?
Yes. Both tenants route through one PXCMail policy and one BAA; per-location admins see only their own location. An outside IT provider can manage all of it from the partner console.
Does PXCMail read our patients’ mail?
Detection runs by deterministic rules (identifiers, document fingerprints, clinical codes). No AI reads mail by default and we never train on customer data. Access to message content is US-only and logged.
How long do we keep email?
HIPAA sets six years for documentation, not for email itself, but most practices keep the archive six years to match. The healthcare archive profile defaults to six years with legal hold.
What is not live yet?
SOC 2 Type I, the Outlook and Gmail add-ins and recipient sign-in with Google or Apple are ROADMAP items. Everything above is available today.