01
Security Foundation & Threat Protection
Advanced antivirus (Microsoft Defender), multi-factor authentication for every account, self-service password reset, and core hardening of your environment. The essential baseline.
Microsoft 365 security for medical practices
Protect your patients’ data. Stay compliant. Keep caring.
WeHelp Security configures the Microsoft 365 your practice already uses to protect patient data, control who accesses it, and bring you in line with GDPR and Belgium’s CyberFundamentals framework.
Specialised in Belgian healthcare practices · No new software if you already have Business Premium
Microsoft 365
GDPR / RGPD / AVG
CyberFundamentals (CCB)
Built for healthcare
Why it matters
Your practice holds the most sensitive data there is.
Medical practices run on Microsoft 365, for email, files and calendars, often with default settings that were never hardened. Staff log in from personal laptops and phones. Patient records sit one weak password away from exposure. Under GDPR, health data carries the strictest obligations, and healthcare is now one of the most targeted sectors for cyberattacks.
Security assessment · Example practiceIllustrative
0of 100
MFA on 4 of 23 accounts
11 personal devices with full access to patient files
No data-loss policy on shared folders
Defender licensed, not yet configured
Typical first assessment, before any workFixable in weeks
ART. 9
Health data = the highest level of GDPR protection.
TOP TARGET
Healthcare is a top target for ransomware and phishing.
UNSEEN
Most practices are exposed and don’t know it.
Services
Three steps to a secure, compliant practice.
Everything below uses tools included in Microsoft 365 Business Premium. You pay for the setup, not for new software.
02
Secure Access & Device Control
Control how staff reach work accounts from personal PCs and phones, separate professional from private data, and enable safe remote access, so people can work anywhere without data walking out the door.
03
Data Protection (DLP)
Policies that stop sensitive documents being copied, downloaded, or stored where they shouldn’t be. Your patient data stays inside your practice.
Ongoing Security · optional
Continuous monitoring, annual re-assessment, access and licence management, and incident support. Stay secure as your practice changes.
Not sure which step you need first?The free assessment tells you. No obligation, no sales call before you ask for one.
Request a free assessmentYou already own the security tools. Most practices just never switched them on.
Microsoft 365 Business Premium already includes enterprise-grade identity, device management, antivirus, and data protection. WeHelp Security configures them properly for your practice, with no extra subscriptions and no new vendors.
Try it: flip the switches. The price never moves.
Microsoft 365 Business Premium0 of 6 switched on
Microsoft Defender for BusinessAdvanced antivirus and threat protection
Multi-factor authenticationEvery account, every login
Conditional AccessWho can sign in, from where, on what
Intune device managementPersonal phones and PCs, kept apart from patient data
Data Loss PreventionSensitive files stay where they belong
Self-service password resetNo more calling IT on a Monday morning
Extra software to buy€ 0
Compliance
Aligned with the standards that apply to you.
We bring your practice up to the CyberFundamentals framework, Belgium’s official cybersecurity standard from the Centre for Cybersecurity Belgium (CCB). It is built on recognised international standards (NIST CSF, ISO 27001, CIS Controls) and is the CCB’s recommended route to GDPR and NIS2 readiness. A named, recognised target, not a vague promise.
EURegulation
GDPR / RGPD
Health data is a “special category” under Article 9: the strictest level of protection in European law.
- Art. 9 Health data needs explicit safeguards and a lawful basis.
- Art. 32 “Appropriate technical measures”: encryption, access control, resilience.
- Art. 33 A breach must be reported to the authority within 72 hours.
How we help: MFA, device control and DLP are exactly the Art. 32 measures an auditor looks for. Audit logs make the 72-hour clock survivable.
BEFramework · our target
CyberFundamentals (CCB)
Belgium’s own framework, in four assurance levels. Each level is a concrete list of measures, so “are we compliant?” gets a yes-or-no answer.
- Small
- BasicOur baseline for practices
- Important
- Essential
How we help: the free assessment maps you against the Basic level. The three service steps close the gaps. Practices that need more can be taken to Important.
NIS2Directive
NIS2-aligned
The EU’s network-and-information-security directive names healthcare as a sector of high criticality. Belgium transposed it in 2024, with the CCB as the national authority.
- Hospitals and larger providers are directly in scope.
- Smaller practices are not, but referring hospitals and insurers increasingly ask them to meet the same bar.
- The CCB accepts CyberFundamentals as the way to demonstrate NIS2 conformity.
How we help: by working to CyberFundamentals from day one, you are already speaking the language your partners will ask for.
CyberFundamentals, in practice
Five functions. Here is what each one means for a medical practice.
Select a function
“Do we know who has access to what?”
- Inventory of every account, shared mailbox and device touching patient data
- Who is admin, and whether they should be
- Where patient files actually live (SharePoint, OneDrive, personal laptops)
“Can a stolen password still open a patient file?”
- Multi-factor authentication on every account
- Conditional Access: no sign-in from unknown devices or countries
- Work data separated from private data on personal phones
- Data-loss policies on shared folders and email
“Would we even notice?”
- Defender watching every PC and mailbox for malware and phishing
- Alerts on impossible travel, mass downloads, new admin accounts
- Audit logs kept long enough to answer the authority’s questions
“It is 8 am on Monday and something is wrong. Who do we call?”
- A one-page incident procedure your staff can actually follow
- Revoke sessions and wipe a lost phone in minutes, not days
- Support for the 72-hour GDPR notification, if it comes to that
“Can we see patients tomorrow?”
- Retention and versioning so ransomware-encrypted files can be rolled back
- Recovery tested, not assumed
- Documentation handed over so the next IT partner, or you, can pick it up
Approach
Simple, planned, and non-disruptive.
- STEP 1
Assess
We review your Microsoft 365 setup and map your priorities against the CyberFundamentals framework.
- STEP 2
Secure
We implement each step in a planned sequence, starting with a kickoff meeting, so day-to-day care is never interrupted.
- STEP 3
Maintain
We document everything, train your team, and optionally keep your environment secure over time.
Why WeHelp
Why WeHelp Security.
Specialised in Belgian healthcare. We understand your obligations and your constraints.
Belgian framework, not foreign checklists. We work to CyFun / CCB standards.
No new software. We configure what Microsoft 365 Business Premium already gives you.
Transparent, fixed-scope packages. You know the cost up front.
About
Who we are.
WeHelp Security is the healthcare security practice of WEHELP IT SRL, a Belgian IT consulting company based in Erpe-Mere. The wider company works with organisations on their ways of working and their Microsoft 365 environments; this practice does one thing: securing medical practices and bringing them into compliance.
We pair deep Microsoft 365 security expertise with a simple promise: make serious data protection accessible to practices that don’t have an IT department.
FrançaisNederlandsEnglish
FAQ
Questions practices ask us.
Do we need to buy new software?
Not if you already have Microsoft 365 Business Premium: everything is included. If you are on a lower plan, such as Business Basic or Standard, you will need to upgrade, and the free assessment will tell you.
Will this disrupt our practice?
No. Work is phased and scheduled around you, starting with a planning meeting.
How long does it take?
Each step takes days, not months, phased over a few weeks.
Are we GDPR compliant after this?
We align your environment to the CyberFundamentals standard, which directly supports your GDPR obligations for health data.
What does it cost?
Fixed-price packages, shared transparently after a free assessment.
Find out where your practice stands. Free.
Request a free security assessment. We’ll review your setup and show you your priorities, with no obligation.
security@wehelp.be
WEHELP IT SRL, Erpe-Mere, Belgium