email encryption for medical lab company

Question

we need to encrypt the emails that contain PDFs that are coming from our laboratory management system to our clients. we do not have access to our clients machines. we dont want to issue everyone passwords because 1. they might forget it, 2. we dont want them to have to enter the password every time they view the PDF. is there a free or NOT free way to encyrpt these emails so that the client does not have to do anything to be able to open them?

is there a pdf tool that will allow for the receiving party to just enter the password ONCE and not have to do it at all after that>?

Answer 1

This might be a better question for Server Fault or Super User, but PGP is still an pretty easy way to encrypt emails.

Answer 2

Using password-based PDF encryption is probably not secure, as the passwords would have to be very complex to avoid brute-forcing.

Instead, issue each user an SSL certificate and use S/MIME to encrypt each email. The certificate can be installed into Thunderbird or the Windows store on the client machine. If it's stored w/o a password, decrypting the email will be automatic. Certificates can also be revoked this way.

Answer 3

A roundabout route would be to create a web app that hosted the PDFs, and email them the link to the PDF. Then you can do what you want with the security on the site, depending on how secure you need it to be.

It could range from as simple as something known only to them (lab ID number followed by user ID number), all the way through to something more complex (and secure) such as a password force-changed on a regular basis.

Plus, that brings the exercise firmly back into the realm of stackoverflow :)