Looking for a CDA Secure Send alternative? Secure ways to share referrals, records, and X-rays

You need to send a referral letter and a set of X-rays to a specialist across town. If your office used the Canadian Dental Association's Secure Send, that would have taken a couple of minutes.

However, since September 30, Secure Send has been offline while CDA investigates a security incident and adds new safeguards. CDA indicated it hoped to restore the service in early November, but hasn't confirmed a date. The association hasn't endorsed any alternatives. That means the choice is yours.

Thankfully, you have options. This guide walks through what's available, what to look for, and how to pick something that fits your workflow, both now and as a backup once Secure Send comes back.

The interruption has prompted some Canadian dental practices to explore Hushmail as an alternative, including South Porcupine Dental in Ontario.

“We've relied on CDA Secure Send for years and felt it was a solid system. With the service unavailable, we needed to find an alternative that supports our PHIPA compliance requirements.”

South Porcupine Dental
Ontario, Canada

What happened to CDA Secure Send?

On September 30, 2026, CDA took Secure Send offline as a precaution while it investigated unauthorized use of the service.

Here's what CDA has shared so far:

• Someone used stolen login credentials to send unauthorized messages with a harmful attachment to approximately 2,000 dentists, representing fewer than 10% of Secure Send subscribers.
• No patient information, confidential information, or CDA Digital Certificates were accessed. The only dentist information involved was names and office addresses.
• CDA is adding safeguards before restoring the service, including mandatory multifactor authentication (MFA).

CDA has not assessed or endorsed any alternative services. Offices that need a solution in the meantime should choose one appropriate to their needs.

Can you send patient records by regular email?

The short answer: regular email may not provide the protection that patient information needs.

Canadian privacy laws require you to protect personal information with safeguards appropriate to its sensitivity. Under PIPEDA's safeguards principle, that includes up-to-date tools like passwords and encryption.

Which law applies to your practice depends on your province. In Ontario, PHIPA governs health information custodians. The Information and Privacy Commissioner expects personal health information exchanged by email between healthcare providers to be encrypted, except in exceptional circumstances, such as emergencies. In Alberta, dentists fall under the Health Information Act. Other provinces have their own rules.

The details vary, but the principle is the same: when you're sending patient information electronically, you need safeguards that match the sensitivity of what you're sharing.

What should you look for in an alternative?

Each option covers part of what Secure Send did. Start with what you're replacing, and look for these:

A quick checklist:

• Encryption for what you send and receive
• Sign-in protection like MFA (the practical lesson from this incident)
• Canadian data storage. Check where patient information will be stored and whether the arrangements meet your province’s privacy requirements.
• A written agreement with the provider. If you are in Alberta, you will need an information manager agreement (IMA)
• File size limits that match what you send. Referral letters and most X-rays are small. CBCT scans can run hundreds of megabytes
• Easy for the other office or patient. Nothing to install, and they can reply securely
• A clear way to save files into your patient records

What are your options?

Here's a practical look at the main categories, matched to the jobs dental offices do most.

Secure email

Send encrypted messages with attachments to other dental practices or patients. Secure email works well for referral letters, records, reports, and smaller imaging files. Check each provider's attachment limits before choosing a service. Large files, such as CBCT scans, may require another solution.

Secure upload forms

Share a form or link so the other office or patient can upload files to you. Best for receiving referrals, records, and intake documents. This is receiving only, so you'll still need a sending option.

Large-file sharing services

Upload large files to a secure cloud service and send a link. Best for CBCT scans and full chart transfers. Check where the data is stored and whether the provider signs an agreement.

Sharing from your imaging software

Some imaging platforms let you share scans as a link that opens a viewer in the browser. Best for large CBCT files. These tools are purpose-built for imaging but may cost extra, and data storage locations vary.

Sharing through your practice software

Some practice management systems offer encrypted exchange between offices. The advantage is that it fits your existing workflow. The catch is that both offices usually need the same system.

Fax

Fax is still used in healthcare, but sending documents to the wrong number can expose patient information. Misdirected faxes accounted for nearly half of reported health privacy breaches in Ontario in 2023.

If your practice uses fax, follow your privacy procedures and verify recipient details before sending.

Which option fits which job?

Where does Hushmail fit?

Hushmail for dental practices is one option for offices that need a straightforward way to exchange confidential documents and simplify the parts of your day that involve referrals, records, patient forms, and everyday messages.

Sending referrals, records, and X-rays

Send from your practice's own email address (like reception@yourdentalclinic.ca). The other office or patient opens your message on a secure page and signs in with their Google, Microsoft, or Apple account, or by creating a password. They can reply securely and attach files. No Hushmail subscription is needed on their end, and there's nothing to install.

Receiving referrals and records

Set up a Secure File Transfer form on your website or share a link. The other office can securely upload referrals and records directly to your Hushmail inbox, without needing a Hushmail account.

Secure forms for patients

Use Hush™ Secure Forms to create intake, consent, and health history forms that patients can fill out and sign electronically. Submissions arrive in your Hushmail inbox, ready to save to your patient records.

Everyday patient communication

Hushmail isn't just for document transfers. You can use it for appointment confirmations, treatment follow-ups, and any message where patient privacy matters. It's a secure channel your office can rely on day to day.

Your practice's own email address

Send from your own domain, like reception@yourdentalclinic.ca, so the other office recognizes your practice. If your domain, email, and security currently sit across separate services, having secure email tied to your own address can mean one less system to manage.

Canadian data storage

Hushmail stores account data on servers in Canada and provides safeguards to support applicable Canadian privacy requirements, including a signed Information Manager Agreement.

Good to know

• Attachments are limited to 20 MB each and 50 MB per email. Secure form uploads allow up to 75 MB across up to 20 files. That's plenty for letters, records, and most X-rays, but CBCT scans will need another route. See maximum attachment size.
• Hushmail works alongside your practice management software rather than integrating with it automatically. You save files to your patient records the same way you would with any email.
• There's no national dentist directory, so you'll need the other office's email address.
• Two-step verification is included on every Hushmail for Healthcare plan. Admins on Growth plans can also require it across all accounts on the practice's domain.

Does your practice still need an alternative once Secure Send comes back?

Even after Secure Send is restored, having a backup means referrals and records keep moving if any tool goes down. Here's a simple plan:

1. Pick an everyday option for letters, records, and standard X-rays.
2. Pick a route for large imaging files like CBCT scans.
3. Turn on MFA everywhere. On Secure Send, on your email, on any tool that offers it.
4. Write it down. A one-page guide your team can follow keeps things running smoothly.

Start with the simplest step

Most dental practices don't need to replace every Secure Send feature at once. Start with a secure way to send referrals and records. It covers the most urgent need, and you can build from there.

Frequently asked questions

Is CDA Secure Send still down?

As of the most recent CDA update (November 11, 2026), Secure Send is still temporarily unavailable. CDA was targeting early November for restoration, pending additional safeguards, including mandatory MFA. As of November 13, the service has not yet returned. Check the CDA Secure Send service notice for the latest status.

Was patient information affected?

CDA says no patient information, confidential information, or CDA Digital Certificates were accessed. The only dentist information involved was names and office addresses.

Can I email dental X-rays securely?

Most intraoral and panoramic X-rays are small enough for secure email (typically a few megabytes each). CBCT scans usually run to several hundred megabytes, which exceeds most email limits. For large imaging files, look into a large-file sharing service or your imaging software's sharing features.

Is Hushmail a replacement for CDA Secure Send?

Not for every feature. Hushmail covers encrypted email, secure forms, and document collection, with Canadian data storage. Secure Send's national dentist directory and 2 GB file limit don't have Hushmail equivalents. It's a practical option for everyday secure communication, alongside a separate route for large imaging files.