Web Hosting for Medical Practices

The website is the small half of web hosting for medical practices

Sit down with a practice manager and the list of things the website needs to do is short. Hours and location. Which insurance is accepted. New patient forms. A phone number that works on a phone. Provider bios. Maybe a link out to whatever patient portal the practice already pays for.

None of that is heavy. It is a few pages of text, some PDFs of intake forms, and a map. A small shared hosting plan runs it without effort, and the entry tier is usually enough for years. If somebody is quoting you a large plan because the word medical appeared in the conversation, ask what the extra capacity is actually for.

Then count the mailboxes. Two physicians, a nurse practitioner, two medical assistants, a biller, a front desk of three, an office manager. Add appointments@, billing@, records@ and referrals@. That is fourteen or fifteen accounts on one domain, half of them shared, all of them holding messages from patients. That is the purchase. The website is the smaller half of it.

It is worth saying out loud because practices routinely buy the wrong thing. They spend an afternoon comparing hosting tiers nobody will ever notice the difference between, and spend no time at all on the mailbox list, which is where the risk lives.

The day somebody leaves

This is the failure that actually happens, and it is almost never dramatic. A front desk employee leaves on good terms. Nobody thinks about it. Four months later somebody notices the old account is still active, still receiving, and still holding access to the shared appointments mailbox with every patient message in it.

Nothing bad may have come of it. That is not the point. The point is that for four months the practice could not have told you who could read patient correspondence, and could not have told anybody asking either.

The fix is not technical. It is a written sequence that runs on the last day, the same way the keys and the badge come back.

1. Change the password, do not delete the account

   Deleting is the instinct and it is the wrong first move. Deleting can take mail with it. Change the password so the person is out, then decide what happens to the contents afterwards.

2. Remove them from every shared mailbox

   This is the step that gets missed, because the shared mailboxes are not their account. Work down the written list: appointments, billing, records, referrals, anything else. Remove the person from each one.

3. Redirect the mail somewhere a human reads

   Point their address at whoever covers the role now, or at the relevant shared mailbox. Patients and referring offices will keep writing to the old address for months. Silence there costs you appointments.

4. Check the forwards and the aliases

   People set up quiet forwards to a personal address to make working from home easier. Those survive a password change. Look for them specifically.

5. Then decide about the mailbox itself

   Once mail is flowing to the right place, you can keep the mailbox for reference, archive it, or close it. That is a business decision and there is no hurry. Making it on week one is what causes the accidents.

6. Update the written list

   Cross the name off. A list that does not get maintained becomes a list nobody trusts, and then everybody goes back to asking around.

Twenty minutes, once, on the last day. Compare that with reconstructing months later who had access to what, from memory, while somebody is asking you the question formally.

Patient information, and what a hosting plan does not promise

This has to be said carefully, and the careful version is more useful than the confident one.

A hosting plan is not a compliance programme. No plan you buy makes a practice compliant with anything, and any vendor who says otherwise is selling you comfort. What a plan can be is one part of an arrangement your own compliance adviser or attorney has reviewed, which usually involves a signed agreement with the provider about how protected information is handled. Ask your adviser what your practice needs before you buy, not after.

The practical version, and the part vendors talk about least, is that most of the exposure is behaviour rather than infrastructure. Patient information arrives by email because patients email things. It sits in the shared mailbox because that is where it landed. It stays there because nobody set a rule about it.

• Decide, in writing, what may and may not travel by ordinary email at your practice.
• Give patients a route that is not email for anything sensitive, and make that route easier to find than your inbox address.
• Assume anything sent to appointments@ will be read by everybody on that mailbox's access list. Keep the list short.
• Treat a website contact form as email, because that is what it is. Do not invite clinical detail into it.

On the site itself, the ordinary hygiene still applies. A certificate on every page so nothing is submitted in the clear, covered on the SSL page, and someone actually responsible for keeping the software current. If the site runs WordPress, WordPress security is worth reading, because an unmaintained plugin on a practice site is a genuinely bad afternoon.

None of this is legal advice and it is not meant to substitute for any. Check what your practice specifically needs with your own compliance adviser or attorney.

How AldoMedia helps

AldoMedia has built and looked after websites for Western New York businesses since 1999, and practices are familiar work. We are an independent authorised reseller rather than the operator of the underlying platform, which means we will tell you plainly when the plan you already have is the right one and the problem is the mailbox list instead.

If you are moving mail from an old arrangement, the sequence that avoids losing messages during the changeover is on the email migration page, and the record-by-record detail is on DNS management. If you are inheriting a site nobody has the logins for, which happens more often than anyone admits, start at taking over a website.

Call 716-771-2536 or tell us how many mailboxes you have and who can read the shared ones. If you cannot answer the second half of that, that is the job.