PDF, portal or TLS? How patients actually receive encrypted email

“Encrypted email” means three different experiences depending on the product, and the difference decides whether patients read your messages. HHS says in FAQ 570 that providers may email patients as long as reasonable safeguards are applied; the method is the provider’s choice. Here are the three, from the patient’s point of view.

1. Transport encryption (TLS)

The message travels over an encrypted connection between mail servers and lands in the inbox as a normal email. The patient notices nothing. This is the right answer whenever both servers support it, which today is most of the time, but not all of the time, and never with certainty unless the sender requires it. That certainty is what the transmission security standard at 45 CFR 164.312(e) is asking you to show.

2. A page with a code (portal)

The patient receives a notification, taps a link, and requests a one-time code by text or email. They read and reply in the browser. No account, no app, no password to remember. Done well, it takes seconds. Done badly, with passwords to create and remember, it is the reason encrypted messages go unread.

3. An encrypted PDF

The message arrives as a password-protected PDF. It works on any device without a web page, which made it popular with older secure-email gateways. The downsides: attachments are awkward, replies are not encrypted unless the product adds a reply page, and “open the PDF with the password we texted you” is a sentence many patients will not finish.

What we do

TLS is required by default. If the recipient’s server can’t negotiate it, or your policy says the message is sensitive, PXCMail uses the page-with-a-code method. We chose it over PDF for one reason: patients read it. The page expires after 30 days by default (configurable from 1 to 90), you can revoke it any time, and every open is logged, which matters because HHS’s guidance on unsecured PHI makes encryption the line between a logged delivery and a reportable breach. ROADMAP: sign-in with Google, Apple or Microsoft, the method Hushmail uses, which removes even the code, is not live yet and is listed on What’s new.

How to decide for your practice

• Appointment reminders with no PHI: plain email is fine; TLS makes it better.
• Anything with a diagnosis, a balance or an identifier: encrypted delivery, automatically.
• Clinical correspondence with hospitals or insurers: S/MIME when they publish a certificate; otherwise the page.

Sources

• HHS, HIPAA FAQ 570, email with patients — confirms providers may email patients with reasonable safeguards, and that patients may ask for unencrypted email after being warned.
• 45 CFR 164.312, Technical safeguards, (e) — requires transmission security for ePHI sent over electronic networks.
• HHS, Guidance on securing PHI (unsecured PHI and encryption) — defines encryption that renders PHI unusable to unauthorized persons, which is what takes a message outside breach notification.