It’s 7:45 on a Monday morning at a small clinic. The front desk phone is already ringing. Patients can’t get into the portal to check their lab results, and the page just spins. By 8:15, the calls change. Patients are asking about an email with the clinic’s name on it, telling them to confirm their insurance details by noon. Nobody at the clinic sent it. The IT lead checks the servers, and everything inside the building looks fine. The problem is somewhere else: someone got into the registrar account over the weekend and changed where the clinic’s domain points.
(This example is hypothetical, but every piece of it is possible.)
Your registrar controls your nameservers, and nameservers decide where your portal, your email, and your website actually go. It’s rarely on a HIPAA (Health Insurance Portability and Accountability Act) checklist. It should be.
A quick word on the rule
The U.S. Department of Health and Human Services (HHS) proposed a major Security Rule update in January 2025 that would make safeguards like encryption and multi-factor authentication (MFA) mandatory. Final action has slipped to July 2027 at the earliest, and today’s rule stays fully in force until then. HIPAA also doesn’t name registrars, DNSSEC (Domain Name System Security Extensions), or DMARC (Domain-based Message Authentication, Reporting, and Conformance), and no registrar can make you compliant on its own. What these tools do is support the safeguards the rule does ask for. Here’s what to ask.
1. Who can change our nameservers, and is MFA turned on?
Your registrar login is a master key. Ask who has access, whether multi-factor authentication is switched on for everyone, and whether changes are logged. If the answer is a shared password, fix that this week.
2. What happens if our DNS (Domain Name System) goes down?
Your portal and your email both rely on it. Ask how it stays up and whether DNSSEC is set up to protect your records from tampering. “We’re very reliable” isn’t an answer. You want to hear how.
3. Is our DMARC policy blocking anything?
DMARC tells receiving mail servers what to do with messages that fake your domain. Plenty of organizations publish a policy that only watches and never blocks. Ask whether yours is set to quarantine or reject. Phishing is one of the most common ways attackers get into healthcare organizations.
4. Who watches our certificates?
An expired SSL (Secure Sockets Layer) certificate can break encrypted connections or show patients a scary warning. Ask who tracks expiration dates and whether you get an alert before one lapses.
5. Do we know every domain and subdomain we own?
The proposed rule asks for a technology asset inventory, and domains count as assets. Old campaign sites and subdomains pointing at retired services are easy to forget and easy to abuse. Start with a plain list: every domain, who owns it, and where it’s registered.
6. Have one trusted technical partner who is there for you.
Many domain and DNS services never touch patient data. Hosting and email might. If a vendor could touch protected health information, you need a BAA, so ask which services it covers and get the answer in writing. If they hesitate, that tells you something.
Can’t get a clear answer to one of these? That’s your starting point, and you don’t need to wait for HHS.
Want to see how this looks for your setup?
101domain handles domains, Cloudflare DNS, managed DMARC, certificate monitoring, and hosting from one team, so there’s one place to ask these questions.