4

I can't seem to find what is standard practice regarding signing/validating pdf files in a medical B2C environment. (A chiropractor's practice counts as medical, doesn't it?)

I find quite a bit about how to include signature fields that require certificates, and plenty of little programs and how-to's geared towards end users. However, far as I know, most people don't have a clue how to generate their own certificate, and would be scared off by such a requirement. I'm also not keen on requiring customers to download some possibly-dubious program to sign it.

About the only thing I have been able to find even approaching helpfulness is the bit at the top of this page about "Quick PDF sign". Is that strong enough for B2C validation though? Is it standard practice?

|improve this question
  • 1
    Are you required to meet HIPAA? Or the Data Protection Act (1998)? If so, they give guidance – Rory Alsop♦ Nov 10 '16 at 20:51
  • @RoryAlsop no, it turns out I missed the memo, and we don't need a digital signature at all, the customer will print it out and sign it physically. I guess that makes this question hypothetical now, but I would like to know the outcomes all the same. Without the need for HIPAA compliance, would an image of a signature be fine, you think? With the need, is this more or less what you meant? tinyurl.com/j8xmlqr – donutguy640 Nov 11 '16 at 1:35
  • For questions about which kind of signature is required, one should add the country one is talking about. – mkl Dec 13 '16 at 10:09
1

I assume now that you are talking about document the customer signs and sends to you, like a order or request for medical service:

Most solutions I have seen in this case, involves external signing. Ergo, you don't sign using PDF signing functions, but instead, sign the whole file as an opaque data object. The reason is that PDF signing either requires a valid CA, or a imported "home-brew CA" for the PDF reader to see the signature as genuine.

Here in sweden, when doing medical services, you fill out the PDF form (or web form or whatever), and then upload it to the medical service. Then you use a electronic ID, here in sweden its called "Mobilt BankID" (Mobile ID app) but I really don't know what you use in your country, to sign it.

And when signing it, you basically take the hash of the file (SHA-1), and send to the electronic signing service. For example: "Signing file form_2016-11-11_00:05.pdf with SHA1 validation value 5C:1C:2D...(rest of SHA-1 hash)"

Then you effectively save the signature you get from the electronic ID service, along with the PDF. If any doubts of tampering appears, you can show that the received PDF file's hash matches the hash inside the electronic ID signature message, and the signature of the message matches the actual signature.

Note that you cannot tamper with the PDF file, like adding notes and such. If you need to add content to the PDF, you have to copy the PDF to a new file, that you can add notes to.

Even if most users do not understand how to verify the hash matches the PDF when they get the on-screen message "to sign a file with hash XX:XX:XX....", it does not matter. Its enough that a few users do understand how to verify it to make tampering a too high detection risk for a attacker.

There must be some official solution (like some government electronic ID or something) intended for customer usage, that is OK to use according to HIPAA or DPA.

However, if you instead are about to sign documents that you are sending to the customer, its enough to purchase a certificate intended for document signing. Then you use PDF signing tools to sign the PDF. The PDF can then be viewed on any computer, and if the PDF software supports digital signatures, the signature will be validated automatically. The customer does NOT need to install any custom software.

|improve this answer
  • Yes, I'm talking about the customer signing and sending it. I don't think we have such a service though, not through the government. – donutguy640 Nov 11 '16 at 1:43
1

It is worth looking into HIPAA/HITECH, as there is at least one section within the technical part of the Act which mentions digital signatures.

If you are looking to validate PDF files, what you can also do is ensure the integrity of the PDF (say, during transmission ie file transfer) as that will also help in terms of validation. For example, if a file has been modified at some point during transmission then you can consider that as invalidated.

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.