We checked the public email and website set-up of 1,337 dental practices, care homes, home care agencies and GP practices registered with the CQC in Yorkshire and the Humber. These are the results. No organisation is named.
When someone sends an email pretending to be your practice, the receiving mail server looks for a DMARC record to decide what to do with it. Only 17% of the organisations we checked tell receivers to quarantine or reject those fakes. Another 24% have DMARC set to monitor only, which reports fakes but still delivers them, and 59% have no DMARC record at all.
That leaves 83% where a convincing fake email, sent to patients, families, staff or suppliers in the organisation's own name, has a good chance of landing in the inbox. The gap was widest for dental practices (91%) and narrowest for care homes (73%).
Share of organisations whose DMARC policy is missing, invalid or set to monitor only.
| Sector | Websites checked | No DMARC | DMARC monitor only | DMARC enforced | SPF missing or broken |
|---|---|---|---|---|---|
| Dental practices | 243 | 69% | 22% | 9% | 6% |
| Care homes | 289 | 46% | 27% | 27% | 3% |
| Home care agencies | 404 | 53% | 30% | 17% | 3% |
| GP practices | 401 | 69% | 17% | 13% | 8% |
| All | 1,337 | 59% | 24% | 17% | 5% |
Percentages are of websites checked in each sector. Of the organisations that receive email at their website domain, 39% use Microsoft 365.
This is not a theoretical risk. Phishing is by far the most common cyber attack on UK businesses: 38% experienced it in the last year, and 12% had someone impersonate them in emails or online. An unprotected domain makes impersonation easy, because the fake arrives from your real address, with your name on it.
Here is what that can lead to for a practice or care provider, and for the people who trust it.
A fake "balance outstanding" or "deposit due" email with a payment link. It looks genuine because it comes from your address. The money is gone, and the complaint lands with you.
"We have changed our bank details." Invoice redirection is one of the most common frauds against small organisations, and the money is rarely recovered.
An email from "the practice manager" asking staff to sign in to check a document. One password can open email, files and patient records.
If personal data is exposed, you may need to report it to the ICO within 72 hours, tell the people affected, and record it in your DSPT. The CQC can ask what happened and what you have changed.
Cyber insurers increasingly ask about email security. Commissioners and the DSPT expect evidence of basic controls. A gap that was known and left open is hard to explain after an incident.
Gmail, Yahoo and Microsoft now expect senders to authenticate their email. Mail that fails these checks is more likely to be filtered as spam, including appointment reminders and results letters.
We are not saying this to alarm anyone. For most organisations it is under an hour of work for whoever manages your email, and it costs nothing.
Figures: UK Government (DSIT) Cyber Security Breaches Survey 2025/26, published April 2026. The National Cyber Security Centre recommends every organisation publishes SPF, DKIM and DMARC and moves DMARC to quarantine or reject.
Type in your website and we read the same public records used in this benchmark, then explain what we find in plain English. No email address needed, and nothing touches your systems.
Contains public sector information licensed under the Open Government Licence v3.0. Source: Care Quality Commission.
You are welcome to quote these figures with credit to Unavoidably Secure and a link to this page. For more detail, or a comment from Andrew Heppinstall, email support@unavoidablysecure.com or call 07749 941111.
Unavoidably Secure (2026). Yorkshire healthcare email security benchmark, October 2026. Unavoidable Studio Ltd. https://unavoidablysecure.com/benchmark/
Download the data: sector totals as a CSV file (counts and percentages for each sector, no organisation names). Free to reuse with credit and a link.
Published 16 October 2026 by Andrew Heppinstall, founder of Unavoidably Secure.
Seen "UnavoidablySecure-Benchmark" in your website logs? That was a single page request made for this research. If you would rather your organisation was left out of future runs, email us and we will exclude it.