HIPAA Glossary · Security Rule concepts
Encryption
Rendering data unreadable without a key. Addressable at rest and in transit under the Security Rule.
Context
Encryption is addressable today (§164.312(a)(2)(iv) at rest, §164.312(e)(2)(ii) in transit) and about to be required under the proposed Security Rule. Pairs with the safe harbor at HITECH §13402(h): encrypted ePHI compromised with keys intact is not "unsecured PHI" and generally does not trigger breach notification. See [Encryption](/platform/encryption/) in the platform.
Related terms
- Safe harbor (encryption) — The breach-notification exemption: if compromised ePHI was encrypted to HHS standards and keys were not compromised, notification is generally not triggered.
- Required vs addressable — Every Security Rule implementation specification is one or the other. Addressable never means optional.
- Technical safeguards — Access control, audit controls, integrity, authentication, and transmission security for ePHI.
Where this fits
This is one of 50+ terms in the HIPAA Glossary. For how HIPAA is structured end-to-end, see the Security Rule guide and the Privacy Rule guide.