No attachments. Don't send patient information, breach letters or scans. Describe the fix and link to a public source instead.