Patient Data by Email: Safe Handoffs Between Practices and Providers

A laboratory request, a billing query and a screenshot for technical support may look similar in an inbox. They should not automatically follow the same delivery route. The decision depends on the specific purpose, the recipient’s authority, the necessary data and the approved channel. This guide helps practices and their providers in Germany make that decision before sending. It supplements general GDPR training for employees with a verifiable handoff process rather than another blanket prohibition list. The legal context remains German and EU law, not US healthcare regulation.

Two approvals: disclosure and delivery channel

First establish whether this recipient may receive the information for this purpose. A general lawful basis alone is not enough for health data: an applicable exception to the prohibition on processing special categories is also needed. Articles 6 and 9 GDPR provide the starting point. The responsible management team should define permitted routine cases with data protection advice. At the point of sending, staff need to recognise the applicable case rather than improvise their own legal analysis while patients are waiting.

Professional confidentiality remains a separate consideration. Section 203 of the German Criminal Code addresses disclosure to participating service personnel and confidentiality commitments; a service contract is not blanket permission to disclose patient information. The workflow must therefore establish whether the specific service requires access. The same boundary appears in reception and relatives scenarios involving verbal disclosure. A familiar face or a known company address does not establish either entitlement or the necessary scope of disclosure. Staff should refer unresolved cases to the designated decision owner.

Check the recipient before filling the address field

The first practical question is who needs which information for which task. A laboratory carrying out a defined order may need different information from a maintenance company. The local sending rule should connect the recipient organisation, responsible function, approved address and permitted data categories. A shared mailbox is suitable only when its actual readership matches the authorised disclosure. Technical delivery does not prove that only entitled people can read the message. Resolve unclear access groups before sending, including temporary cover and external mailbox administrators.

Confirm new or changed addresses through an already established contact route. A telephone number supplied inside the suspicious email is not independent verification. Check lookalike domains, autocomplete suggestions and obsolete distribution lists as well. Recipient verification is a practical example of social engineering at work: a convincing urgent request can still cause an unauthorised disclosure. For recurring handoffs, maintain an approved recipient directory with an owner and a record of changes. This is a recommended organisational control, not a statutory form that every practice must use.

AI-generated

Minimise the dataset, not just protect the attachment

Limit the content before choosing the channel. Does the provider actually require the complete report, or would a case reference and a technical description solve the problem? Remove unnecessary pages, earlier messages and extra attachments. Check filenames, subject lines, previews and visible patient names in screenshots. A neutral subject prevents a diagnosis appearing directly in a notification. Pseudonyms and case references remain personal data where identification is still possible. They do not remove the need for access controls or a lawful disclosure decision.

Approval should cover the exact file that will actually be attached. Open the final version and check the patient match, page count and any other records bundled into the export. Mail merges and spreadsheets may contain additional information in an overlooked worksheet. Role-based healthcare training becomes concrete here: reception checks identity and address, the appropriate clinical or administrative professional checks necessary content, and IT maintains the approved delivery route. Not every participant needs to see all clinical details to perform their part of the check.

TLS is not the same as end-to-end encryption

The DSK guidance on email transmission distinguishes transport encryption from end-to-end encryption. Transport encryption protects a connection; it does not automatically establish who can read content on participating servers or in the destination mailbox. For high-risk transmission, the guidance generally requires end-to-end encryption and qualified transport encryption, taking account of the specific risks and compensating measures. Professional secrets warrant especially careful risk assessment. An indicator saying “TLS active” is therefore not, by itself, an adequate approval decision for sending a sensitive clinical report.

Agree with IT which methods are approved for each handoff and what happens when protection fails. If the agreed safeguards cannot be established, an automatic fallback to unprotected transmission is not the answer. A password-protected document is not a universal substitute for an assessed method either. Encryption quality, secure key delivery, metadata protection and recipient verification must work together. Sending the password in the same email does not solve misdelivery. Staff need a named alternative route rather than an instruction to somehow make the attachment arrive.

KIM, a portal or another approved route

For suitable communication within the German telematics infrastructure, gematik describes KIM as an encrypted and signed email service. Its directory contains verified address details for connected organisations with a KIM address. That supports technical identification, but does not establish whether this particular organisation and function need the information. KIM is not a route to arbitrary external contractors or ordinary patient inboxes. Check actual availability, the use case and local access permissions before making it the default in the practice’s procedure.

A suitable portal can provide an alternative where identity verification, account protection, permissions and secure delivery fit together. A publicly forwardable link without appropriate access protection is not a dependable solution. Guidance on passwords, MFA and passkeys supports account-access decisions but does not replace approval of individual documents. Also define permission expiry and withdrawal, notifications without sensitive content, and the handling of expired links. The practice needs to know who owns a failed retrieval so that staff do not improvise an insecure workaround under pressure.

AI-generated

Three cases for the next team briefing

Case one: the IT provider requests a screenshot of an error. Reception would accidentally include the name and diagnosis from the last patient record opened. The first correct decision is not “send it encrypted”, but “reduce the content”. Where possible, reproduce the fault with test data or a cleaned excerpt and inspect the result. If real data remain necessary for diagnosis of the technical issue, the responsible person decides the scope, contractual arrangements and channel. A support request alone does not establish entitlement.

Case two: an external billing provider announces a new address at short notice and requests the entire monthly file. Pause sending and independently confirm the change first. Then check the provider’s role. Processing on behalf of the practice requires the conditions and contractual arrangements in Article 28 GDPR; not every recipient is automatically a processor. The existing arrangement must fit the actual operation. Even where the role is clear, disclose only necessary data. Pressure to finish the accounting run does not replace these checks.

Case three: a practice continuing treatment needs a report before an appointment. The responsible professional confirms the purpose, scope and authority to disclose; staff then check the recipient and approved channel. If KIM is available at both ends and suitable for the operation, use the defined workflow. If transmission fails, follow the agreed fallback process rather than sending spontaneously to a private address. Escalate clinical urgency immediately to the responsible medical professional so that care needs and data protection can be considered together.

A compact approval card instead of endless exceptions

A local approval card can ask six questions: Is the purpose clear? Is disclosure permitted? Are the recipient and access group confirmed? Is the dataset limited to what is necessary? Does the approved channel work? Can the handoff be traced? Any unresolved answer goes to the named decision owner. A second-person check may be useful for particularly sensitive or large disclosures; here it is a risk-based recommendation, not a claim of a universal legal requirement. Clear prior decisions should make routine cases faster without removing essential checks.

Documentation should evidence the operation without creating another collection of clinical content. Useful fields include an internal reference, recipient function, channel, time, responsible person and any justified exception decision. A delivery status proves only what the particular system actually confirms, not necessarily clinical processing or reading by the intended person. Training records without spreadsheets can separately capture who practised which version of the sending rule. Operational evidence and learning evidence serve different purposes and should not be confused when reviewing a handoff or an incident.

Recognise misdelivery and escalate promptly

If a message has been misaddressed, start the internal reporting process immediately. Preserve the necessary facts, stop further sends and arrange to restrict access where possible. A recall function or deletion confirmation does not automatically eliminate the risk. The responsible controller assesses the breach and considers notification under Article 33 and, where applicable, communication under Article 34 GDPR. Authority notification is required without undue delay and, where feasible, within 72 hours of awareness unless risk to individuals is unlikely. Employees should not wait for that deadline before reporting.

Practise the moment of uncertainty too: a colleague realises after sending that autocomplete selected the wrong contact. Assess whether they report promptly and provide the relevant facts, not whether they can recite a legal risk classification. This follows the logic of phishing training focused on reporting behaviour. An incident should lead to concrete changes, such as cleaned address lists or an additional check on particular exports, rather than simply assigning the general course again without fixing the conditions that caused the error.

Test the workflow with real roles and fictional data

Start with one frequent handoff and test it using fictional patient data. Ask reception, the responsible professional and IT to examine the same send from their respective perspectives. Check whether everyone can identify the exception owner and handle a technical failure correctly. Only then extend the pattern to additional recipient groups. Review the workflow when providers, systems or responsibilities change and according to risk. This guide does not claim a universal statutory annual interval for this particular exercise or use a completion certificate as proof that the technical channel is secure.

The ConformBase healthcare package combines data protection, confidentiality and hygiene training and is currently offered as an add-on to a suite. For email handoffs, training establishes shared understanding; the local sending procedure, technical approval and legal classification remain the organisation’s responsibility. Begin with a specific case and the roles involved. Success means a defensible workplace decision: send correctly, remove unnecessary data, or stop and involve the responsible person. It does not mean that a course certificate certifies every future transmission or replaces assessment of a provider’s actual systems.