Updated on
A referral letter, a report for a patient’s doctor, a certificate for an insurer: in a clinic or practice, PDFs with patient data go back and forth every day. When you need to merge or shrink them, a free PDF site is quickly found. But many of those sites first send your file to their server.
Why uploading patient data is a problem
Under the GDPR, health data is a special category of personal data, with stricter rules than, for example, an address. If an online service processes your file on its server, that service is generally a processor. You normally need a data processing agreement for that, and you must be able to check where the data ends up and how long it’s kept. With a free PDF site you happened to find, that’s rarely in place.
PDFCommunity works differently: merging, compressing, protecting and signing happen entirely in your own browser. The file isn't uploaded, so no extra party is involved. Read more in GDPR-friendly PDF tools.
This is general information, not legal advice. If you’re unsure what applies to your practice, ask your professional association or a data protection specialist.
How to bundle and send a medical file
- Gather the documents in one folder. For example the report, the referral letter and the certificate. Give them names that start with a number (01-report.pdf, 02-referral.pdf), so you can see straight away in the list whether the order is right; if not, fix it with the arrows. It’s best not to put the patient’s name in the file name.
- Open Merge PDF, choose the files, check the order and click Merge.
- Too big to email? Make the file smaller with Compress PDF. Scanned documents in particular usually get a lot lighter.
- Sign if needed with Sign PDF. That’s a simple electronic signature (an image of your signature), not a qualified signature with a certificate.
- Protect the PDF as the last step with Protect PDF and choose a strong password. The file is encrypted with AES-256.
- Send the password separately, for example by text message or over the phone, and never in the same email as the attachment.
If the recipient asks for a qualified electronic signature, for example one made with an electronic ID card or a qualified certificate, Sign PDF isn’t suitable. And if your practice uses a secure messaging service for healthcare providers, use that: a password-protected PDF is mainly an alternative to ordinary email.
Three more everyday tasks
A paper prescription as a PDF
Still getting paper prescriptions or referral letters? Lay the page flat in good light and take a sharp photo with your phone. Open JPG to PDF, choose the photo and the A4 page size, and download the PDF. A phone photo is turned the right way up automatically. On an iPhone, a HEIC photo works directly in Safari; in another browser, save it as JPG first. A photographed prescription stays a picture, though: its text isn't recognised.
Send only the pages that are needed
A twelve-page hospital report, while your colleague only needs the conclusion and the imaging? Send only what is needed: that is also the idea behind data minimisation in the GDPR. In Delete pages, type the pages that can go, for example 3, 7-9, or choose the pages to keep with Extract pages.
Protect several files in one go
If you choose several PDFs at once in Protect PDF, they all get the same password and you download them together as a zip. Handy for a series of reports for the same recipient. For different patients, protect each file separately, each with its own password.
After sending
- Clear your Downloads folder. The tool keeps nothing, but the result does stay on your computer. On a shared practice computer, that's the first habit to build.
- A forgotten password can't be recovered, not even by us. Keep the original until the recipient has been able to open the file.
- Large files work best on a computer. On a phone, a large file can be slow or too heavy for the memory. The tool then warns you before it starts.
You don’t have to take our word for it: Verify it yourself explains how to use the network tab or airplane mode to check that your files aren't uploaded. And once you’ve opened the site, most tools also work offline.
Frequently asked questions
Can I edit patient data with an online PDF tool?
That depends on the service. A tool that sends your file to a server processes health data on your behalf, and then you normally need arrangements such as a data processing agreement. A tool that does everything in your browser doesn't receive the file. This is not legal advice.
Is a password-protected PDF secure enough to email a report?
With a strong password that you share separately, AES-256 protects the attachment itself well. It’s still ordinary email, though: the subject line and the text of your email aren’t encrypted, so don’t put any medical details there.
Can I make a scanned report searchable or convert it to Word?
Searchable, yes: OCR PDF recognizes printed text (not handwriting) in your browser and adds it as an invisible layer. A PDF with real text can be converted with PDF to Word, but the layout may differ from the original.