Securing Data for Transmission: HIPAA and FERPA compliance
 

We have to implement a facility to provide download capability of files to a limited group of clients. The information in the files is subject to HIPAA and FERPA guidelines. We will be using SFTP, but want to go further. We want to encrypt the files themselves at 128-bit or higher and password protect them before we put them up for transmission. Our site and sources are RHEL 4 and 5 servers. Our clients will be a mix of WinXP, Mac osX, and Linux. We do not want to have to purchase/maintain digital signature certificates. We do want to be able to script the encryption and password assignment on the files. We want our clients to have to provide a password to open the file once received.

Is there a single-source, multi-platform solution for accomplishing this scenario? Is single-source necessary? Are purchased products necessary?

GnuPG works on all platforms mentioned. That's not the problem. It's the scripting of passphrases. That definately does not comply with common sense, any Best Practices let alone official standards...

Sometimes the file will be generated by an application from database sources. The output file will need to be encrypted and password protected before put up for transmission. We would want to script a password generation algorithm and then assign the generated password to the file. We are NOT talking about putting a password into a script.

Encoding with OpenSSL work on all platforms mentioned too. Might be easier.