The other day a friend who works in healthcare asked me which method of communication was more secure, faxing or email. He qualified his question by saying that his office faxes patient records all day, every day, which should not surprise anyone.
I scratched my head and rattled off some considerations, private vs hosted email service, but his question really got me thinking.
Is a sending a fax more secure or less secure than sending an email when communicating sensitive data?
Consider the following simple variations:
- Self-hosted private email server vs fax.
- Hosted private email server (collocated server for instance) vs fax.
- Hosted GMail (for instance, not picking on Google) service vs fax.
For the sake of this question imagine that in each email instance above, basic best practices are being followed.
I am wondering does one method have a greater attack surface than the other. Is 'getting it right' on the security footprint easier in one instance vs the other, fax vs email?
For the purposes of comparison consider the emails / faxes to be coming from patients to healthcare providers and from providers to other providers.
firstname.lastname@example.org -> email@example.com
firstname.lastname@example.org -> provider@otherProvider.com
So 'best practices' would cover what the healthcare providers should be doing to guarantee that they are running as secure a system as they can given this scenario.