Jon,
Was it about file saving defaults, or something else? Curious. If it something I can help with let me know, I owe you call anyway.
One low-pain solution is to use the patient portal if you already have Updox - integrates nicely with AC.
There are also several vendors going down the eVisit model path, so you get paid for doing email correspondence; YMMV.
The suggestion from Nephros of being no-disclosing is another approach [artful].
I would tell you that a *large* corporate client had a patient data breach, and faced the CA SB1386 mandatory disclosure statues that proved quite expensive. Again - they are a big player, not a practice, but the point is really isn't worth the risk to your practice.
