Patients open the email that says lab results.
That is why your domain is worth impersonating. Appointment reminders, portal resets and telehealth links are trusted, expected, and trivial to forge until you publish an enforcing policy. DDMARC gets you there — and tells your compliance officer precisely what data it holds while doing it.
Does any of this contain PHI?
Mostly no — and the one place it could, you control from your own DNS. Here is every category of data we hold, and what is inside it.
Aggregate reports
No PHIThe daily XML summaries receiving providers send about your domain. This is the bulk of what we store and the basis of every chart in the product.
Counts and metadata only. No message content, no recipient addresses, no subjects — the report format has no field for them.
Forensic samples
Not collectedWith no ruf= tag in your DMARC record, receivers send no per-message samples and we hold none. You still see that failures happened, from which sources and in what volume — you just do not see the individual messages.
This is the default, because it is what a DMARC record without a ruf= tag produces. Nothing on our side has to be switched off for it to be true.
DNS records
PublicYour published SPF, DKIM, DMARC, MTA-STS and TLSA records, re-read on a schedule so we can tell you when something drifts.
Public by definition. Nothing here is confidential, which is why the free domain check needs no account and no agreement.
In practice: aggregate DMARC reports are metadata — domains, IP addresses, pass and fail counts — and carry no PHI. Forensic samples are different: receivers that send them may include the subject line, and in healthcare a subject like “Your results from Dr Chen” is arguably identifying. That is why they are opt-in twice over: a Protect plan, and a ruf= tag you add yourself.
Aligned to the safeguards. Not “HIPAA certified” — nobody is.
There is no such thing as a HIPAA certification for a vendor. Compliance is a state your organization is in; what a vendor can do is align to the technical safeguards and hand you evidence. “Aligned” below is our self-assessment that a control maps to the safeguard — not an audit finding. Expand a row to see the artifact you can put in front of an auditor. For how DMARC maps to the Security Rule and how to roll it out in a clinic, read DMARC and HIPAA: what auditors check.
Every action in DDMARC is attributable to a named user, not a shared login, and role-based access separates who can read reports from who can publish a policy. The limit worth stating: this is access control over your DMARC data, not over ePHI. It evidences the control on this system, and says nothing about your EHR.
Aggregate reports are an examinable record of who sent mail as your domain and what receivers did with it, retained per your plan, not for the day or two a mail log usually survives. It records authentication outcomes and configuration changes — not message content, and not access to records.
DKIM is an integrity control in the literal sense: it signs the message so a receiver can detect alteration in transit, and DMARC is what makes a failed signature consequential, not advisory. Continuous DNS monitoring covers the other half — a record silently changed or dropped is the alteration nobody notices until mail stops.
MTA-STS requires inbound mail to arrive over TLS instead of leaving it to opportunistic encryption that downgrades silently, and TLS-RPT reports the failures. That reporting is the part an auditor asks about, because a control you cannot observe is a control you cannot evidence.
A BAA is in preparation and cannot be signed today — ask us for timing before you build it into a compliance schedule. It is worth having even though report data is metadata, because forensic samples and support access are the paths where identifying detail could reach us.
Five messages your patients already trust.
Ranked the way an attacker ranks them: by how likely someone is to click without thinking.
Lab and test results
The one email a patient opens immediately, often on a phone, often while anxious. Nobody inspects a sender address in that moment.
Credential theft through a fake portal login, and a patient who now distrusts every real result notification you send.
Patient portal password resets
Expected, transactional, and the exact shape of message people are trained to act on without hesitation.
Account takeover of the portal itself — which is where the actual PHI lives. This is the highest-value forgery on the list.
Telehealth visit links
A link the patient must click at a specific time, usually sent minutes before the appointment.
A malicious meeting link, or a diverted consultation. Also the hardest forgery for a patient to question, because the timing is right.
Appointment reminders
High volume, low scrutiny, and usually sent by a third-party tool that may not be authorized in your SPF record.
Mass phishing at scale, plus your legitimate reminders landing in spam once receivers learn to distrust the domain.
Billing and insurance notices
Contains amounts and account references, so a forgery only needs to look plausible for a moment.
Payment diversion, and a complaint that reaches your compliance office as a suspected breach, not a phishing report.
Healthcare has been the costliest industry to breach for fifteen years running.
What we can hand you before contract.
Start free. A BAA, when available, will be an Enterprise term.
Nothing stops you monitoring a practice domain on the free Monitor plan today — aggregate reports hold no PHI, so there is no reason to wait for paperwork to find out where you stand.
Or have the work done for you.
Both are priced on the pricing page and scoped in writing before anything is billed.
A specialist owns your authentication, not a ticket queue.
From p=none to p=reject, done with you, not explained to you.
Both sit outside PHI for the same reason the platform does: the work is on DNS records and aggregate report data, not on patient systems.
Check a patient-facing domain, then start free.
No card, no BAA required, no PHI involved — the free check reads public DNS only, and aggregate reports are metadata. Both tell you whether your portal and reminder mail can be forged today; a BAA is in preparation, and we will give you a date before you build it into a schedule.
What buyers on this page ask.
Healthcare is a frequent phishing target. DMARC at enforcement stops attackers from spoofing your domain in emails to patients and staff, and protects deliverability of appointment, billing, and portal notifications under the Google/Yahoo sender rules.
Data is encrypted at rest (AES-256-GCM) and in transit (TLS 1.3) with multi-tenant isolation and role-based access control. For a Business Associate Agreement or specific HIPAA requirements, contact us to discuss your needs.
DDMARC offers both US and EU data residency options, so you can keep DMARC report data in the region your organization requires.
Under 5 minutes for a single domain. Setup is self-service, and managed MTA-STS and BIMI hosting are included so you do not have to maintain those policy endpoints yourself.
Other solutions, comparisons and pricing. The product is the same on all of them — what changes is who has to approve it.