As HIPAA's language is somewhat vague when it comes to actual technical requirements, what are best practices for PHI encryption for HIPAA compliance?

I've seen varying levels at different organizations. Some just encrypt it in transfer, some when at rest as well. One organization I dealt with required PGP encryption of files even when transferring over SFTP.

  • 1
    Encryption when "at rest" should have always been a necessity, independent of HIPAA compliance. The first time a staff member loses a laptop with patient data that is unencrypted... – Iterator Nov 6 '11 at 15:41

I work in healthcare integration and dealing with encryption is a must. If we are designing real-time HL7 interfaces to 3rd party vendors who are outside of our corporate network then we absolutely setup a full time dedicated and of course encrypted VPN connection between the two of us. That's mostly because a lot of applications can't support SSL encryption on a HL7 TCP/IP interface (although most integration engines do).

When doing file transfers we insist on using FTPS (FTP over SSL) or SFTP (Secure File Transfer Protocol). Some vendors require us to do PGP encryption and signing of files as well.

At a minimum you must have transport encryption. On top of that, data encryption can only help.


As a note about "data at rest". For our MSSQL Servers, we have implemented Transparent Data Encryption (TDE). We are regarding this as within the bounds to protect PHI. To be fair, we don't handle claim or patient info.


"Best" practice is risk assessment and risk mitigation. Encryption is only one of the layers of risk mitigation.

Use of encryption algorithms certified by FIPS 140-2 Annex A would be best practice; generic use of TLS or SFTP without configuring cryptographic cyphers appropriately doesn't cut it.

Use of database layer data encryption may be appropriate, for instance, if there is a risk that physical hardware may be stolen; if the hardware is in a hardened data center, use of database layer encryption may impress people ("our data is encrypted at rest") without appreciably mitigating disclosure risks.

  • 2
    Additionally, there is a difference between the perceived safety of an encrypted-on-disk database storage system (with the keys also on the disk) and having a physical separation to keep unauthorized personel away. – Marshall Anschutz Oct 28 '11 at 18:52

This page directly from HHS.gov has a link to some good approaches and best practices for the technical requirements of HIPAA. I would start with the links under Security Rule Educational Paper Series and also check out the links to the NIST publications for more technical guidance.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.