Microsoft 365
Your mailbox holds more patient data than your website does.
The website is the part everyone looks at. The email is where the referrals, the reports, the insurer correspondence and the test results actually live — and it’s usually had far less thought put into it.
The three setups we find
Email on the web hosting
Common on older practice sites, because it came free with the hosting package. It means patient correspondence sits on a shared web server with no backup worth the name, no meaningful protection against phishing, and mail that increasingly gets rejected by other providers. If your email address ends in your practice domain and your website host set it up, this is probably you.
A personal account with the practice name on it
A Gmail or Outlook.com address, or a practice domain pointed at a consumer account. It works, right up until the person who owns it leaves, or their password appears in a breach, and there is no administrator anywhere who can do anything about it.
A Microsoft tenant nobody administers
The most common of the three, and the most deceptive. Somebody set up Microsoft 365 four years ago. Since then: no backup, no filtering beyond the defaults, multi-factor authentication switched off because it annoyed someone, three mailboxes belonging to people who left, and a global administrator account whose password is written on a card in a drawer.
Why this matters more in healthcare
A compromised mailbox at most businesses is a nuisance and some fraudulent invoices. A compromised mailbox at a private clinic is unauthorised access to health data, which means an assessment against the 72-hour reporting deadline, probable notification to the affected patients, and a conversation with your indemnity provider. The mailbox is the highest-value target you own.
What we do instead
One price per mailbox with four things in it, none of them optional.
Microsoft 365 Business Premium
Not the cheap tier. Business Premium is the one that includes the security and device management features — conditional access, device compliance, data loss prevention. Selling practices a cheaper licence and then charging to bolt security back on is a business model we’ve chosen not to have.
Backup
Microsoft protects their infrastructure, not your data. If someone deletes a mailbox folder or a ransomware event encrypts a OneDrive, Microsoft’s retention windows are shorter than most practices assume. We back up mail, calendars, contacts and files separately, every day.
Filtering
Layered on top of Microsoft’s own protection, because the built-in filtering is adequate rather than good. Targeted phishing at a named practice manager is a different problem from bulk spam, and it’s the one that actually costs people money.
Managed signatures
Consistent signatures applied centrally, so every clinician’s email carries the right practice details and regulatory wording without anyone maintaining it by hand. Change it once, it changes everywhere.
Administration
Joiners set up, leavers removed and their mailbox handled properly, MFA enforced, shared mailboxes configured. This is the part that quietly doesn’t happen when a practice administers its own tenant, and it’s the part that leaves ex-employees with live access.
£320 per mailbox per year
Or £30 a month per mailbox, rolling. Everything above is in that price — there is no security tier and nothing to bolt on later. Full detail on the pricing page.
Moving your email over
Mail migrations are more delicate than website migrations, because a mistake means a bounced patient enquiry rather than a slow page. So we plan them separately, run them outside clinic hours, and keep the old mailboxes accessible until you’re satisfied.
What we need: administrative access to wherever the email is now, control of the domain’s DNS, and a list of who needs a mailbox. Historic mail comes across with it — you don’t lose your archive.
If you already have Microsoft 365
You don’t need to change licence to work with us. We can take over administration of your existing tenant, add the backup and filtering, and fix whatever has drifted. That’s usually a shorter piece of work than a migration and it’s the more common starting point.
Free check of your current setup
Tell us your domain. We’ll tell you where your email is hosted, whether it’s protected against spoofing, and what your current setup would cost to put right. No obligation.