I see what yr trying to do, but as I said I saw nothing in the regs. that
required this, and it specifically mentions patients records/details being
emailed to outside parties.
If you encrypt then the other party will need the key to read it.
I realise yr the otherside of the pond, but we had similar problems here
with many Institutions misinterpreting our Data Protection Act. You may have
heard of the case involving a school caretaker who murdered two small
children, last year. The Police had destroyed their records of the man,
previously, because he had never been convicted, prior to this case, because
they thought thats what the Act required, when in fact it did'nt.