Take the 2-minute tour ×
Healthcare IT Stack Exchange is a question and answer site for healthcare IT professionals and solution providers. It's 100% free, no registration required.

As HIPAA's language is somewhat vague when it comes to actual technical requirements, what are best practices for PHI encryption for HIPAA compliance?

I've seen varying levels at different organizations. Some just encrypt it in transfer, some when at rest as well. One organization I dealt with required PGP encryption of files even when transferring over SFTP.


migrated to security.stackexchange.com by jonsca May 1 '12 at 11:08

This question belongs on our site for Information security professionals.

Encryption when "at rest" should have always been a necessity, independent of HIPAA compliance. The first time a staff member loses a laptop with patient data that is unencrypted... –  Iterator Nov 6 '11 at 15:41