- New England's Only Dental-Specific IT Provider
- (207) 333-2206
Can Dental Offices Auto-Forward PHI to Personal Email?
-
Ezra Angelo
- • October 18, 2026
Forwarding work email to a personal inbox may seem convenient, but it can create an uncontrolled copy of patient information.
Dental practices often need staff to read messages outside the office. Automatically forwarding everything to a personal email account, however, can move PHI beyond the practice’s normal security and oversight.
A safer approach keeps messages in managed work accounts, protects remote access with appropriate controls, and limits external forwarding to narrowly reviewed exceptions.
Copies may remain in personal inboxes, synced devices, downloads, and backups. Before permitting external forwarding, evaluate the destination, safeguards, vendor relationships, retention, and whether the practice can investigate and remove access when needed.
Automatic forwarding creates another destination for patient information.
The original message may remain in the managed mailbox, while an additional copy enters a different security environment.
Managed Work Mailbox
Protected through the practice’s configured identity controls, MFA, access permissions, auditing, and retention policies.
Personal Email Account
May create copies on personal devices, in external backups, or in accounts beyond the practice’s normal monitoring and offboarding procedures.
Turning forwarding off prevents future copies through that rule, but it does not automatically delete messages already delivered to the external account.
Three ways staff can access work email remotely without auto-forwarding PHI.
Provide remote access through practice-approved systems while maintaining individual accountability.
Managed Email App
Use an approved Outlook or Gmail application with the employee’s work account, MFA, and appropriate device or application controls.
Work account stays managedProtected Web Access
Allow staff to sign in through an approved browser session with appropriate access policies and security monitoring.
No personal inbox forwarding requiredDelegated Shared Mailbox
Grant authorized employees access to shared work mailboxes through their individual accounts instead of copying messages elsewhere.
Individual access can be revokedRemote access still needs safeguards appropriate to the device, user, and information involved. Managed apps and browser access do not automatically make an unmanaged device secure.
Four checks when suspicious external forwarding is discovered.
Unauthorized forwarding can be a sign of account compromise. Review the rule and investigate what other access an attacker may have gained.
Find the forwarding rules
Review inbox rules, administrator-configured mailbox forwarding, and mail-flow settings for external destinations.
Preserve the evidence
Document destinations, rule details, available audit events, relevant sign-ins, and the suspected exposure period.
Contain the compromise
Remove unauthorized forwarding, revoke suspicious sessions, and review mailbox permissions, credentials, and connected applications.
Review the data exposure
Identify which messages may have been forwarded and determine whether further privacy investigation or notification is required.
Microsoft 365 provides policies to restrict automatic external forwarding. Administrators should verify the effective settings and investigate unauthorized rules rather than relying on default behavior alone.
Frequently Asked Questions
Ekim IT Solutions works exclusively with dental practices, supporting offices across all 50 states remotely. We set up secure access to the managed mailbox from anywhere, so identity, MFA, auditing, retention, and offboarding all stay under your control.
-
- • October 18, 2026
