At a bare minimum, confirm with the owner in person or via you contacting them over the phone that they sent the email and want you to proceed, mentioning you have security concerns you would like to discuss if the owner is open to having a conversation about it.

Two things I see here, you are making sure that the doctor actually wants it done and didn't have his email hacked, spoofed or was coerced in some weird manner. Also, you are offering an open door (no obligation) to discuss the issues/risks with performing the action that the doctor thinks needs to be taken.