Is it safe to send a medical letter or test result?

Almost everything written about this is written for the clinic — how a practice sends results to a patient without breaking HIPAA. If you are the patient, and an insurer, an employer's occupational health service, a school, a solicitor or a landlord has asked you to email or upload a medical letter, none of that applies to you. You are not a covered entity and no rule stops you sending your own record to anybody you like. The questions worth asking are different: do they need the whole letter, what will they keep, and what is in the file besides the paragraph they asked about. MEDISCRUB masks names, addresses, record and policy numbers while leaving the clinical detail readable, and SEAL redacts a PDF so the text is genuinely gone rather than hidden under a box. Nothing is uploaded.

The rules are on the sender, and you are not the sender they mean

HIPAA in the United States, and the UK and EU GDPR elsewhere, place obligations on organisations that hold health data — clinics, hospitals, insurers, employers. They do not restrict what you do with a record about yourself. That is why the search results for this question are almost entirely vendors selling compliant email to practices: it is a real problem, but it is not yours.

The obligations do land on the organisation asking you, and that is worth knowing because it gives you something to ask for. In the UK and the EU you can ask what they will use it for, how long they will keep it, and on what lawful basis. A legitimate recipient answers that in a sentence. It is also perfectly normal to ask whether they need the full letter or only the part that answers their question.

What is actually in the letter

A medical letter is usually more specific than the thing being asked about, and the parts people forget are structural rather than clinical:

• Your NHS, Medicare or insurance number and your date of birth, in a header on every page.
• Your full address, and often your GP's, which locates you.
• The clinic's letterhead and department, which names the specialism — and on its own can disclose the condition before a word of the letter is read. A letter from an oncology, psychiatric, genitourinary or termination service says something in the header.
• The copy list at the foot, naming other people who received it.
• A dictation footer: the typist's initials, the dictation date, an internal reference.
• Unrelated history. A letter about your knee routinely recites a past condition in the background paragraph, because the consultant was writing to another clinician and not to your insurer.
• The file's metadata, if it is a PDF the practice generated: the producing software, timestamps, and sometimes an internal document reference. X-RAY shows it.

When to send it whole, and when not

The pattern is the same as anywhere else on this site: redacting a document for somebody legally entitled to it makes things worse, and sending a full clinical history to somebody who asked whether you can lift boxes is a disclosure you cannot take back.

If you are redacting it

1. Keep the original untouched. You may need to produce it.
2. Start from what they need, not from what you want hidden.
3. For text you can paste, MEDISCRUB masks names, dates, record and policy numbers, addresses, phone numbers, emails and IDs while leaving the clinical wording readable — which is the right way round when the recipient needs the substance and not the identifiers. It can keep dates, because a date is often clinically meaningful.
4. For a PDF, use SEAL. It rebuilds each page from pixels so there is no text layer left under the boxes. A black rectangle drawn in a viewer or an annotation app is a picture over text that is still selectable — the most common way a redaction fails.
5. Do the letterhead and the header on every page, not just the first, and the copy list at the foot.
6. Strip the metadata with SCRUB or CLEANROOM.
7. Read it back and try to select what you removed.

Sending it

Ordinary email is readable at several points between you and the recipient and sits in both mailboxes indefinitely. That is usually an acceptable risk for one letter to a named person, and it is your risk to take — but if you would rather not, put the file in an encrypted container and send the passphrase by a different route. CAPSULE makes one that opens in any browser, so the recipient needs nothing installed. STRONGBOX makes an AES-256 zip if they would rather have that.

Use the organisation's own portal when they have one. It is genuinely better than email, and it is the one piece of the standard advice that transfers.

And not through a website

The ordinary way to redact a PDF is to upload it somewhere, which puts the unredacted letter — the exact document you were being careful about — on a stranger's server before any of it is blacked out. Everything here runs in the tab you have open; you can check that in the browser's network panel, or by turning the network off after the page loads.

This is about the document, not about your care or your rights. It is not medical or legal advice, and what a particular insurer, employer or court can require of you varies by country and by contract.