what kind of signature to require in a medical B2C environment

Question

I can't seem to find what is standard practice regarding signing/validating pdf files in a medical B2C environment. (A chiropractor's practice counts as medical, doesn't it?)

I find quite a bit about how to include signature fields that require certificates, and plenty of little programs and how-to's geared towards end users. However, far as I know, most people don't have a clue how to generate their own certificate, and would be scared off by such a requirement. I'm also not keen on requiring customers to download some possibly-dubious program to sign it.

About the only thing I have been able to find even approaching helpfulness is the bit at the top of this page about "Quick PDF sign". Is that strong enough for B2C validation though? Is it standard practice?

Answer 1

I assume now that you are talking about document the customer signs and sends to you, like a order or request for medical service:

---

Most solutions I have seen in this case, involves external signing. Ergo, you don't sign using PDF signing functions, but instead, sign the whole file as an opaque data object. The reason is that PDF signing either requires a valid CA, or a imported "home-brew CA" for the PDF reader to see the signature as genuine.

Here in sweden, when doing medical services, you fill out the PDF form (or web form or whatever), and then upload it to the medical service. Then you use a electronic ID, here in sweden its called "Mobilt BankID" (Mobile ID app) but I really don't know what you use in your country, to sign it.

And when signing it, you basically take the hash of the file (SHA-1), and send to the electronic signing service. For example: "Signing file form_2016-11-11_00:05.pdf with SHA1 validation value 5C:1C:2D...(rest of SHA-1 hash)"

Then you effectively save the signature you get from the electronic ID service, along with the PDF. If any doubts of tampering appears, you can show that the received PDF file's hash matches the hash inside the electronic ID signature message, and the signature of the message matches the actual signature.

Note that you cannot tamper with the PDF file, like adding notes and such. If you need to add content to the PDF, you have to copy the PDF to a new file, that you can add notes to.

Even if most users do not understand how to verify the hash matches the PDF when they get the on-screen message "to sign a file with hash XX:XX:XX....", it does not matter. Its enough that a few users do understand how to verify it to make tampering a too high detection risk for a attacker.

There must be some official solution (like some government electronic ID or something) intended for customer usage, that is OK to use according to HIPAA or DPA.

---

However, if you instead are about to sign documents that you are sending to the customer, its enough to purchase a certificate intended for document signing. Then you use PDF signing tools to sign the PDF. The PDF can then be viewed on any computer, and if the PDF software supports digital signatures, the signature will be validated automatically. The customer does NOT need to install any custom software.

Answer 2

It is worth looking into HIPAA/HITECH, as there is at least one section within the technical part of the Act which mentions digital signatures.

If you are looking to validate PDF files, what you can also do is ensure the integrity of the PDF (say, during transmission ie file transfer) as that will also help in terms of validation. For example, if a file has been modified at some point during transmission then you can consider that as invalidated.