How to mail, encrypt and send information for use by non-technical users?

Question

A doctor friend of mine wants to email reports to her patients, but doesn't do so as she only wants it to be viewed by the patient. Any recommendations? I am thinking possible solutions might be:

1. Encrypted E-mail: Encrypt the email using private/public keys. I think this might be too difficult for the patient recipient.

2. Encrypted Attachement: Encrypt the file (not the email) using some software and a phrase for the key, and give the phrase to the patient in person or over the phone. The patient (who most certainly uses Windows or Apple and not Linux) would then, however, need to have access to the software.

   I guess a link to download the software would work, but probably not desirable. Does Windows and Apple have this functionality embedded? Or maybe zip it and encrypt it, or wrap the file in some of executable when clicked will extract it?

Or maybe something else?

Answer 1

1. Windows Office, LibreOffice and other office suites offer a Save as.. dialog with Password as an option. Save the message as a document with password and attach to the email.

MS Office/Open Office/LibreOffice DOCX all use Microsoft Enhanced RSA and AES Cryptographic Provider (rather than the more-secure Microsoft AES Cryptographic Provider), which provides RSA and triple-DES encryption, but not AES-256 or greater. Thus, DOCX encryption is of only moderate strength, and may or may not be HIPAA compliant.

2. Compression applications such as 7-Zip and PeaZip offer encryption strength up to AES-256, and can encrypt and compress multiple documents at once, e.g. x-ray TIFF, OV summary DOC etc. This is more secure and also more efficient than using each application's encryption. It is simpler for the recipient, too, who would need to input just one password to open all files in the archive. It has been my experience that the various Zip tools are compatible, as well, even across OS -- for example, 7-Zip files encrypted under Windows OS can be opened in Ubuntu's archive manager.

As you state, the password should be given through a medium other than email, e.g. fax or phone. Best might be to call the recipient after the email is received and stay on the phone to talk through the decryption process.

Answer 2

First you suggest this:

“Encrypt the email using private/public keys.”

Then you suggest this:

“Encrypt the file (not the email) using some software and a phrase for the key, and give the phrase to the patient in person or over the phone.”

The chances of either solution working for average patients is 100% zero. Most people don’t understand what PGP/GPG encryption is and sending an encrypted attachment and then giving a password over the phone is a mess waiting to happen.

That said I think the only solution that could practically work would be an encrypted PDF with password protection. The PDF can be sent as an attachment and an password can be passed along by phone, mail or even email.

But that said you also state this; bold emphasis is mine:

A doctor friend of mine wants to email reports to her patients, but doesn’t do so as she only wants it to be viewed by the patient.

At the end of the day, you can only control how to lock something, but you cannot prevent anyone from seeing the contents if the person on the other side is sloppy with password storage. Meaning, an encrypted PDF is a good solution, but if your patient leaves the password on a PostIt™ note on their desk or prints it out, there is nothing to stop anyone nearby from reading that content.

Of course, that is an expected risk, but thought it would be best to mention it. At the end of the day the best you can hope for is to protect the PDF in transmission from doctor to patient; past that all bets are off.

And FWIW, the HIPAA (The Health Insurance Portability and Accountability Act) does accommodate for the use of emails to communicate with patients regarding their care regardless of the e-mail being encrypted or unencrypted; bold emphasis is mine:

Does the HIPAA Privacy Rule permit health care providers to use e-mail to discuss health issues and treatment with their patients?

Yes. The Privacy Rule allows covered health care providers to communicate electronically, such as through e-mail, with their patients, provided they apply reasonable safeguards when doing so. See 45 C.F.R. § 164.530(c). For example, certain precautions may need to be taken when using e-mail to avoid unintentional disclosures, such as checking the e-mail address for accuracy before sending, or sending an e-mail alert to the patient for address confirmation prior to sending the message. Further, while the Privacy Rule does not prohibit the use of unencrypted e-mail for treatment-related communications between health care providers and patients, other safeguards should be applied to reasonably protect privacy, such as limiting the amount or type of information disclosed through the unencrypted e-mail. In addition, covered entities will want to ensure that any transmission of electronic protected health information is in compliance with the HIPAA Security Rule requirements at 45 C.F.R. Part 164, Subpart C.

Apparently HIPAA Security Rule requirements at 45 C.F.R. Part 164, Subpart C can be found somewhere over here, but I can’t seem to find the specifics.