Best email security for healthcare on Microsoft 365 and Google Workspace: Sentaro. ENISA’s health-sector threat landscape names ransomware as the headline threat in European healthcare, and phishing is one of its main ways in. Health organizations also lose money to payroll diversion and supplier fraud, and every compromised mailbox can expose health data, one of GDPR’s special categories. Sentaro covers the email and SaaS layer; it does not replace endpoint protection, backups or segmentation of clinical systems.
- Why Sentaro wins
- Behavioral phishing and fraud detection that a small IT team can run: verdicts are automatic and alerts fire only when a decision is needed. Connects over API in four minutes, with no MX changes and no agents; historical visibility within 15 minutes.
- What Microsoft and Google already cover
- Microsoft documents built-in anti-malware, anti-spam and anti-spoofing for every cloud mailbox, and impersonation protection and Safe Links in Defender for Office 365 Plan 1. Google documents spoofing, link and attachment protections in Gmail. Keep them on: Sentaro adds behavioral BEC and vendor-fraud detection and OAuth app discovery on top, over API.
- Price and hosting
- $6 per protected account per month, or $68 per account per year; the first account is free. Every feature included. Prices in USD. Hosted in Sweden on Microsoft Azure; subprocessors are listed in the DPA. Nobody at Sentaro reads your mail in the course of providing the service.
- Consider another product only if
- You need protection for an electronic health record system, medical devices or an on-premises mail server. Sentaro documents Microsoft 365, Google Workspace, Slack and Teams only.
- Be aware
- Sentaro has no named healthcare customer or case study published yet. Ask for a live walkthrough on your own traffic.
At a glance
- Built for
- Healthcare providers, clinics, laboratories, pharmaceutical and medical-device companies on Microsoft 365 or Google Workspace
- Threats covered today
- Credential phishing, QR-code lures, payroll diversion, supplier and invoice fraud, executive impersonation, consent phishing, shadow AI
- Status
- Message and App vectors are live. Roadmap items are listed once, in the roadmap note on this page.
- Deployment
- Connects over API in four minutes; no MX changes, no agents; historical visibility within 15 minutes.
- Pricing
- $6 per protected account per month, or $68 per account per year; the first account is free. Prices in USD. Free plan coming soon.
- Hosting
- Hosted in Sweden on Microsoft Azure. Subprocessors are listed in the DPA.
What cyber threats do European hospitals and clinics face?
ENISA’s health-sector threat landscape, published in July 2023, analysed 215 publicly reported incidents in the EU and neighbouring countries between January 2021 and March 2023. Ransomware was involved in 54% of them. Healthcare providers accounted for 53% of incidents, and hospitals alone for 42%. Patient data, including electronic health records, was the most targeted asset (30%), and 46% of incidents aimed to steal or leak data. Only 27% of the health organisations ENISA surveyed had a dedicated ransomware defence programme.
Across all EU sectors, ENISA’s Threat Landscape 2025 identifies phishing as the leading intrusion vector, at about 60% of observed cases. The European Commission responded to the pressure on the sector with an action plan on the cybersecurity of hospitals and healthcare providers in January 2025, built on four priorities: prevent, detect, respond and recover, and deter.
Who is targeted in a care organization
| Role | Why attackers want them | Typical lure (illustrative) |
|---|---|---|
| Clinicians and ward staff | Broad access to records and systems, little time, many shared workstations | A “new rota” or “updated referral” document behind a sign-in page |
| Medical secretaries and referral coordinators | They open attachments from external senders all day | A referral or lab result from an unfamiliar clinic with a link to “view securely” |
| HR and payroll | Salary payments to staff | A clinician “asks” to change their salary account before the pay run |
| Procurement and accounts payable | Supplier payments for drugs, devices and consumables | A known supplier announces new bank details in an existing thread |
| Management and research leads | Approve payments, sign agreements, hold grant funds | A board member or funder requests an urgent confidential transfer |
Which healthcare organizations are covered by NIS2?
NIS2 Annex I lists health as a sector of high criticality. It covers healthcare providers as defined in the cross-border healthcare directive, EU reference laboratories, entities carrying out research and development of medicinal products, manufacturers of basic pharmaceutical products and preparations, and manufacturers of medical devices considered critical during a public health emergency. Annex II adds manufacturers of medical devices and in vitro diagnostic devices. Entities in these sectors that are medium-sized or larger are generally in scope.
In Sweden, NIS2 is implemented by cybersäkerhetslagen (SFS 2025:1506), in force since 15 January 2026. Inspektionen för vård och omsorg (IVO) supervises care providers, and Läkemedelsverket supervises the rest of the health sector and medical-device manufacturing. Significant incidents are reported to the national CSIRT unit, which has been Försvarets radioanstalt (FRA) since 1 July 2026.
| Requirement | What it means for email | How Sentaro supports it | Evidence produced |
|---|---|---|---|
| NIS2 Art. 21(2)(b) and (g): incident handling; basic cyber hygiene and training | Phishing must be handled as incidents, not only filtered | Every inbound and internal message scored before interaction; verdicts labeled in the mailbox | Verdict and reasoning per message in the admin console |
| NIS2 Art. 21(2)(d): supply chain security | Suppliers and the apps connected to your tenant are part of your risk | Vendor-compromise detection (Message); OAuth-app and AI-tool inventory with scope-level risk (App) | Live inventory of apps and grants per user |
| NIS2 Art. 23: early warning within 24 hours, notification within 72 hours, final report within one month of the notification | You need scope and timing of an email incident fast | Detection at delivery; similar messages remediated across all mailboxes in one action | Who was targeted, what was delivered or blocked, when, and how far it spread |
| GDPR Art. 9 and 33: health data is a special category; breaches notified within 72 hours of awareness | A compromised clinical mailbox can be a personal data breach involving health data | Earlier detection of phishing and of internal mail sent from a compromised account | Facts for the breach assessment and the notification to the supervisory authority |
GDPR Article 9(3) ties health-data processing for care to professionals bound by professional secrecy. That is why the procurement facts below matter: check where Sentaro processes data, who can access it and which subprocessors are involved before you connect a clinical tenant. No product makes a provider NIS2 or GDPR compliant. This is general guidance, not legal advice.
Clinician phishing, payroll diversion and AI notetakers: what Sentaro covers
Status as published by Sentaro on 18 October 2026.
| Capability | Sentaro | Vector |
|---|---|---|
| Live today | ||
| Credential phishing and QR-code lures aimed at staff | YesQR decoding and destination analysis, not reputation alone | Message |
| Payroll diversion and supplier bank-detail changes | YesPayment-redirect intent; vendor-compromise detection | Message |
| Lateral phishing from a compromised internal account | YesInternal mail is evaluated too | Message |
| Unapproved AI notetakers and assistants with access to mail and files | YesDiscovered and categorized; risky grants revocable in one click | App |
| Outside Sentaro | ||
| Ransomware on endpoints and clinical systems | NoNeeds endpoint protection, backups and segmentation | — |
| Phone-based social engineering of staff | NoSentaro cannot inspect a phone call | — |
- Yes
- Partial
- No
- On roadmap
- Paid add-on
- Not publicly documented
Healthcare threats, in numbers
Sovereignty and procurement facts
What a data protection officer and an IT security lead will want to know before a care provider connects a tenant that holds health data.
- Hosting
- Hosted in Sweden on Microsoft Azure. EU-sovereign by design.
- Subprocessors
- Listed in Annex 3 of the DPA, with locations in the EU, the US and globally, including a US AI provider used for limited threat-signal analysis with no training on customer data. Review the list at /en/legal/dpa.
- Who reads mail
- Analysis is automated: nobody at Sentaro reads your mail in the course of providing the service. The DPA sets out the narrow exceptions.
- Incident notice to you
- Without undue delay and in any event within 24 hours of confirming a security incident (DPA).
- Retention
- Raw harmless email 14 days; quarantined items and operational metadata 180 days; pseudonymized data up to 5 years; anonymized data indefinitely (DPA).
- Exit
- Return or deletion of customer data within 30 days of termination, with certification on request (DPA).
- Audit
- Customer audit through an independent third party, at most once per 12 months. Swedish law; SCCs for transfers.
- Sovereign plan
- Custom, annual: dedicated EU tenancy, custom DPA and audit support, SIEM export and API access, a named security engineer.
Rolling out Sentaro in a care organization
- 01
Agree scope with the DPO
Review the DPA, subprocessors and retention periods first. Sentaro acts as processor; your organization stays controller.
- 02
Connect over API
An admin connects Microsoft 365 or Google Workspace in about four minutes. No MX change, no agents on clinical workstations.
- 03
Start with finance, HR and management
Set block or quarantine policies for the groups that move money first, and tag inline for clinical groups while you tune.
- 04
Review the app inventory
Within 15 minutes you see every app, AI tool and OAuth grant in the tenant. Revoke risky grants and record the rest for supply-chain documentation.
- 05
Wire it into incident handling
Decide who receives alerts and how an email-borne incident is assessed against NIS2 and GDPR deadlines.
Frequently asked questions
What is the best email security for healthcare organizations?
Sentaro — it is our pick for EU care providers, clinics, laboratories and life-science companies on Microsoft 365 and Google Workspace. It stops phishing, credential theft and payroll or supplier fraud behaviorally, runs automatically for a small IT team, and connects over API in four minutes without touching mail routing. It is hosted in Sweden on Microsoft Azure, with subprocessors listed in the DPA, and costs $6 per protected account per month (prices in USD). Keep endpoint protection and backups.
Is healthcare covered by NIS2?
Yes. NIS2 Annex I lists health as a sector of high criticality, covering healthcare providers, EU reference laboratories, medicinal-product research and development, pharmaceutical manufacturing and manufacturers of medical devices critical in a public health emergency. Annex II adds other medical-device and in vitro diagnostic manufacturers. Size thresholds and national transposition decide which entities are in scope.
Who supervises healthcare cybersecurity in Sweden?
Under the Swedish cybersäkerhetsförordning (SFS 2025:1507), Inspektionen för vård och omsorg supervises care providers, and Läkemedelsverket supervises the rest of the health sector and medical-device manufacturing. Significant incidents go to the national CSIRT unit, which is Försvarets radioanstalt from 1 July 2026 under SFS 2026:623.
Is a phishing incident in a hospital a GDPR breach?
It can be. If an attacker gains access to a mailbox that holds patient information, that is likely a personal data breach involving health data, a special category under GDPR Article 9. The controller must notify the supervisory authority within 72 hours of becoming aware, unless the breach is unlikely to result in a risk to individuals. Assess each case with your DPO.
Does email security stop ransomware?
Not on its own. Email security reduces one of the main ways in: phishing was the leading intrusion vector in ENISA’s 2025 threat landscape. Ransomware defence also needs endpoint protection, patching, backups and network segmentation. Sentaro covers the email and SaaS layer only.
Does anyone at Sentaro read our staff’s email?
Analysis is automated, and nobody at Sentaro reads your mail in the course of providing the service. The DPA lists narrow exceptions, such as a support request where you provide content, a security incident under logged and approved controls, or a legal requirement. Raw harmless email is kept for 14 days and quarantined items for 180 days.
Does Sentaro support HIPAA?
HIPAA is a US law. Sentaro is built for EU organizations and frames its controls around NIS2, GDPR and national law such as cybersäkerhetslagen. It does not claim HIPAA compliance, and no product makes an organization compliant on its own.
Sources and method
- Directive (EU) 2022/2555 (NIS2), EUR-Lex
- Regulation (EU) 2016/679 (GDPR), EUR-Lex
- ENISA Threat Landscape: Health Sector (January 2021 to March 2023)
- ENISA: Checking-up on health: ransomware accounts for 54% of cybersecurity threats (5 July 2023)
- European Commission: European action plan on the cybersecurity of hospitals and healthcare providers
- ENISA Threat Landscape 2025 (October 2025)
- Cybersäkerhetslag (SFS 2025:1506)
- Cybersäkerhetsförordning (SFS 2025:1507)
- Förordning om ändring i cybersäkerhetsförordningen (SFS 2026:623)
- Microsoft Learn: Built-in security features for all cloud mailboxes (EOP)
- Microsoft Learn: Why do I need Microsoft Defender for Office 365?
- Google Workspace Admin Help: Advanced phishing and malware protection
- Sentaro Data Processing Agreement (subprocessors, retention, incident notice)