Home › Guides

Microsoft 365 security checklist for Bradenton dental and medical offices

By Greg Mitchell · Squared Away Tech · October 12, 2026

Dental and medical offices in Bradenton and the rest of Manatee County often use Microsoft 365 for email, scheduling notes, staff files and the occasional referral or insurance document. Your practice-management or EHR system may live somewhere else, but the Microsoft 365 account still holds a lot of sensitive information, and it’s often the way attackers get in.

This checklist covers the Microsoft 365 side. It isn’t a HIPAA compliance program and doesn’t replace your risk assessment or advice from your compliance consultant, but these are the settings I’d check first in a small practice.

Sign-ins

• MFA on every account, including the doctor or owner, the office manager and any admin accounts.
• No shared logins. A single “frontdesk@” account used by four people means you can’t tell who did what. Give each person their own account and use a shared mailbox for the front desk instead. Shared mailboxes don’t need their own license.
• Legacy authentication blocked, so older email apps can’t skip MFA.
• Two named admin accounts at most, kept separate from everyday email.

Email

• Automatic forwarding to outside addresses blocked. Forwarding staff mail to a personal Gmail “to check it at home” sends patient information outside your control.
• Encrypted email available and used when sending patient information. Depending on your license, Microsoft 365 includes message encryption that staff can apply from Outlook.
• SPF, DKIM and DMARC set up on your domain so scammers can’t easily impersonate the practice to patients or vendors.
• Staff know the common scams: fake vendor invoices, fake “shared document” links and payroll direct-deposit change requests.

Laptops, front-desk PCs and phones

• Disk encryption (BitLocker on Windows, FileVault on Mac) on every computer that holds or opens patient information.
• Screen lock on front-desk and operatory computers, since patients walk right past them.
• Phones that get work email protected, with a passcode and the ability to remove practice data if the phone is lost or the employee leaves. Microsoft Intune can do this without touching personal photos and apps.

Staff changes

• Block the account the day someone leaves, and hand their mailbox to the person taking over.
• Review accounts every few months. Hygienists, assistants and front-desk staff often turn over, and old accounts tend to linger.
• Remove licenses from former staff so you’re not paying for people who are gone.

Files and backup

• Limit “anyone with the link” sharing in OneDrive and SharePoint.
• Know what’s backed up. Microsoft keeps deleted items for a limited time, but that isn’t the same as a backup you control. If an account is hijacked or files are deleted, a separate Microsoft 365 backup lets you restore them.

Cyber insurance and vendors

Insurers commonly ask about MFA, admin accounts, backups and email filtering. It helps to have the answers written down before renewal. (How to prove MFA to your insurer.)

Getting help

If you’d like to know where your practice stands, a Microsoft 365 Security Checkup is a read-only review of all of the above with a plain-English report. Nothing is changed, and nothing touches your practice-management software. If you’d rather start small, the free 20-minute checkup call below checks your sign-in and email forwarding settings. Squared Away Tech is based in Lakewood Ranch, just east of Bradenton, and can meet in person to go over findings.

Squared Away Tech serves offices of 5 to 100 people in the Tampa Bay and Sarasota area (Bradenton, Sarasota, Tampa, Ellenton, Lakewood Ranch, St. Petersburg, Palmetto, Venice and Parrish), serving small offices across Florida, and remotely anywhere in the U.S. Mon–Fri 5–9 PM and Sat 9 AM–5 PM (Eastern Time). Daytime and Sunday appointments available on request; daytime calls get a same-evening callback. Back to the home page · More guides

This guide is general information, not legal or insurance advice. Every office’s setup is different.