HealthCare Security - HIPAA

Security in PDF is problematic. You can encrypt the file so that a password would be required to open it, but there are tools that can remove that in a second. I don't know how strict the regulations you need to follow are, but you might want to consider something like DRM protection, or something like a secured website.

I just want to add emphasis to and expand some points Try67 made. You can use standard password security to encrypt a PDF with sufficient strength to meet some technical requirements imposed by the regulations. Such documents can be safely transmitted electronically using email, but that's just small part of the puzzle. The next challenge is to devising a system that ensures that passwords are generated/applied/transmitted/communicated in a secure manner. For example, sending an encrypted PDF via email can be sufficiently secure, but you cannot then send the required open password by email as plain text. If an email account were compromised, the data in the encrypted files would be too. Use of the same document open password for multiple documents would also represent a significant vulnerability and would be a very bad idea. A system that uses standard security is not the best general approach for data that needs to be protected under HIPAA regulations, even though it can be in limited circumstances. The best way to protect PDFs would be with DRM, such as Adobe's LiveCycle Rights Management, perhaps along with other access controls. DRM allows a great deal of control that simply is not possible otherwise.

This is a complicated issue that requires a thorough understanding of the issues and is ultimately well beyond the scope of this forum.

George:

I am looking into LiveCycle Rights Management now. Thanks for your input.

As George states, HIPPA regulations are not something trivial, but I do know that Adobe's LiveCycle Rights Management solution does have several of the features required to become compliant. Documents can be encrypted and there are features in the Rights Management solution for self registration (getting you around the issue of having to communicate a password in order to gain access to a document as the end user manages that themselves). There is more information on Adobe's offering at: http://www.adobe.com/products/livecycle/rightsmanagement/. You can also see an in depth solution brief on how Adobe technology is used within the healthcare industry at: http://www.4point.com/pdf/95010846_solhealthcare_sb_ue.pdf.