I am under the assumption that mailing an un-encrypted CD (PDF File) of the patient's record TO the patient is tantamount to mailing paper copies, and therefore complies with HIPAA issues.
So, am I wrong?
(Admittedly would rather use encrypted files, but if the patient had the technical expertise to deal with encrypted PDF or ZIP files I would have used the patient portal or email.)

Roger
(Nephrology)
Do the right thing. The rest doesn?t matter. Cold or warm. Tired or well-rested. Despised or honored. ? --Marcus Aurelius --