Encryption in Transit
Cryptographic protection of ePHI moving between systems or networks, typically via TLS.
1 min read · Last reviewed May 23, 2026
At a glance
- Category
- Security
- Primary sources
- 3
- Workspace handoff
- compliance binder →
Where this comes up
This sits inside the security risk analysis under 45 CFR 164.308(a)(1)(ii)(A) — workstation controls, EHR access roles, ePHI transmission encryption, audit logging, vendor risk, and incident response. Reviewers expect dated evidence of the control, not a policy PDF that says it exists.
Full definition
What it is in practice
45 CFR 164.312(e) requires transmission security, with encryption as an addressable specification. TLS 1.2+ on all web traffic, secure email gateways for outbound clinical mail, and VPN or zero-trust tunnels for remote access are the practical standard.
How it shows up in your practice
Email is the most common gap. Plain SMTP between clinics is rarely encrypted end-to-end; pick a HIPAA-aware mail provider or use a secure-message portal for clinical communications.
Sources
- 45 CFR 164.312 — Technical safeguardshttps://www.ecfr.gov/current/title-45/section-164.312
- HHS — Breach Notification Rulehttps://www.hhs.gov/hipaa/for-professionals/breach-notification/index.html
- NIST SP 800-66 Rev. 2 — HIPAA Security Rule Implementation Guidehttps://csrc.nist.gov/pubs/sp/800/66/r2/final
Document transmission security in the Compliance Binder
Open compliance binder →Related terms
- SecurityEncryption at RestCryptographic protection of stored ePHI such that the data is unreadable without the decryption key.
- SecurityTechnical SafeguardsTechnology and the policy and procedures for its use that protect ePHI and control access to it.
- SecurityTransmission SecurityTechnical security measures to guard against unauthorized access to ePHI that is being transmitted over an electronic communications network.
D3rx is a healthcare-billing and compliance research aid maintained by D3rx Inc. Articles are drafted by an LLM (Anthropic Claude) against primary HHS, OCR, CMS, eCFR, NIST, and state-regulator publications, and reviewed for restraint and source fidelity by the D3rx team.
Reviewer status: a named credentialed reviewer (CHC, CHPC, or healthcare attorney) is being engaged. Until that engagement is finalized, this page does not claim credentialed review.
Related across the archive
- GlossaryEncryption at RestCryptographic protection of stored ePHI such that the data is unreadable without the decryption key.
- GlossaryTechnical SafeguardsTechnology and the policy and procedures for its use that protect ePHI and control access to it.
- GlossaryTransmission SecurityTechnical security measures to guard against unauthorized access to ePHI that is being transmitted over an electronic communications network.
- GlossaryAccess ControlsTechnical policies and procedures that allow only authorized persons or software programs to access ePHI.
- GlossaryAdministrative SafeguardsPolicies and procedures designed to manage the selection, development, implementation, and maintenance of security measures protecting ePHI.
- ComplianceAnnual HIPAA Training Curriculum (What to Cover + How to Document)A 2026 annual HIPAA training curriculum for small healthcare practices — eight required modules under 45 CFR 164.530(b) and 45 CFR 164.308(a)(5), with documentation templates.
- RegulationHIPAA Breach Notification Rule Overview (45 CFR 164.400-414)When unsecured PHI is accessed, used, or disclosed in a manner not permitted, the entity must follow individual, HHS, and (in some cases) media notification requirements within defined timelines.
- SRAHIPAA Contingency Plan for a Small PracticeWhat the Security Rule contingency plan standard at 45 CFR 164.308(a)(7) actually requires, including data backup, disaster recovery, emergency mode operation, and testing — for a small practice.
This glossary entry is a research aid for billing and compliance staff. It does not provide legal, medical, or financial advice and does not replace counsel. References cited link to primary sources at HHS, OCR, CMS, eCFR, NIST, and the relevant payer or industry body.