Healthcare, social care and related professional services often need to share sensitive information with named people outside one system. A report may go to a specialist, insurer, legal adviser, commissioning body or partner organisation. An image may be required for a legitimate review.
The first principle remains data minimisation: do not share information merely because a protection tool exists. When sharing is necessary and lawful, recipient-linked copies can add a useful layer of accountability.
Begin with purpose and authority
Before creating any copy, confirm why the information is needed, who is authorised to receive it and whether a less sensitive version would meet the same purpose. Remove unrelated pages and unnecessary identifiers where possible.
ExactMark does not determine your legal basis, consent requirements, professional duties or retention obligations. Those decisions remain with the responsible organisation and its advisers.
Protect the route as well as the file
A marked document should still be sent through an appropriately secure channel. Use strong authentication, managed accounts, encryption in transit and access controls suitable for the information. Recipient attribution is not a substitute for preventing unauthorised access.
If the information is viewed through a private portal, the ExactMark SDK can link each verified Web Session to an opaque reference that only the customer can map to the signed-in viewer. If it must leave as an image or PDF, ExactMark Imprint can create a different copy for each recipient.
Keep recipient records accurate and limited
The value of a recipient-linked copy depends on the record behind it. Use a real, necessary identity rather than a broad department label when individual distribution is appropriate. Restrict workspace access so only authorised team members can create copies or investigate evidence.
Recipient details are themselves personal data. Keep them accurate, retain them for a justified period and do not expose them in filenames or visible watermarks unnecessarily. ExactMark stores recipient identity behind the protected workspace rather than embedding a person's name visibly across the content.
Understand the file lifecycle
The original upload is processed to create the marked output and is not retained as a permanent original-file archive. The marked copy is stored privately for authorised access, while its attribution record can remain available for future analysis.
This design reduces unnecessary duplication, but it does not remove the organisation's responsibility to understand where its own source and output files are stored. Map the complete workflow, including email, local downloads, case systems and backups.
If sensitive material surfaces
Preserve the best available evidence and record where it was found. Avoid repeated conversion or editing. Submit the artifact to Evidence Lab and choose the appropriate search scope: ExactMark Imprint for a recipient-linked file, or Web Apps for a screenshot from an authenticated portal.
A confidence-scored attribution result should support—not replace—a human investigation. Consider whether the recipient's account, mailbox, device or internal distribution route could have been compromised. A matched copy does not by itself establish intent or misconduct.
Build a proportionate response
Depending on the content and circumstances, a healthcare information incident may require prompt involvement from privacy, security, clinical governance, legal or senior management colleagues. Follow the organisation's established incident process and obtain specialist advice where required.
ExactMark is most valuable when introduced as part of that wider system:
- Share the minimum necessary information.
- Use controlled, authenticated channels.
- Create individual copies where recipient accountability is justified.
- Preserve evidence carefully.
- Review automated findings with people who understand the context.
Sensitive sectors do not need louder security theatre. They need quiet controls that fit real work, protect privacy and leave reliable evidence when trust breaks down.