Encryption was "addressable" under the Security Rule
No specific cryptographic standards mandated
Organizations could use outdated protocols (TLS 1.0, 3DES)
Alternative safeguards allowed in place of encryption
Inconsistent implementation across healthcare sector
Encryption is now "required" for all ePHI
Specific standards mandated (AES-256, TLS 1.2+)
Deprecated protocols must be disabled
Key management requirements established
Regular encryption audits required
Organizations have a 6-month window to achieve full compliance with the new encryption standards. However, certain deprecated protocols must be disabled immediately.
You must protect PHI both when stored and when transmitted
PHI stored on servers, databases, laptops, mobile devices, and backup media
AES-256 encryption minimumPHI transmitted across networks, internet, or between systems
TLS 1.2 or higher minimum| Category | Standard | Primary Use | Status |
|---|---|---|---|
| Symmetric Encryption | AES-256 (Advanced Encryption Standard) | Data at rest, bulk encryption | Required |
| Transport Layer Security | TLS 1.2 or 1.3 | HTTPS, secure communications | Required |
| SSH/SFTP | SSH-2 with strong key exchange | Secure file transfer, remote access | Recommended |
| Email Encryption | S/MIME or PGP/GPG | End-to-end email encryption | Required for PHI in email |
| Full Disk Encryption | BitLocker, FileVault, LUKS | Laptops, desktops, mobile devices | Required |
| VPN Encryption | IPsec or OpenVPN with AES-256 | Remote access to internal systems | Required |
These encryption methods are no longer acceptable under HIPAA
Multiple critical vulnerabilities (POODLE, etc.)
Weak cryptographic algorithms, deprecated by NIST
Cryptographically broken, vulnerable to attacks
Insufficient key length, vulnerable to brute force
Collision vulnerabilities, cryptographically weak
Run vulnerability scans and protocol audits to identify systems still using deprecated encryption methods. Organizations found using these protocols after the deadline will face increased scrutiny and potential enforcement actions.
Impact: If attacker gains access to system, they can decrypt data
Solution: Store encryption keys separately using key management system (KMS) or hardware security module (HSM)
Impact: PHI may be encrypted in production but not in test/dev
Solution: Apply same encryption standards to all environments containing PHI, including backups and archives
Impact: System vulnerable to downgrade attacks and weak encryption
Solution: Disable weak ciphers, require forward secrecy, use Mozilla SSL Configuration Generator
Impact: Susceptible to man-in-the-middle attacks
Solution: Implement mutual authentication, certificate validation, and certificate pinning
Impact: Increased risk if key is compromised over time
Solution: Implement automated key rotation every 12-24 months minimum