Encryption at rest and in transit is addressable today, almost always reasonable and appropriate, and about to be required under the proposed Security Rule. Encryption tracks the posture per asset and system, with the §164.306(d) rationale captured in the one place it is not implemented.
What it does
- Records encryption state (at rest, in transit, media) per ePHI asset, pulling verification from cloud and MDM where possible.
- Captures the §164.306(d) rationale on exceptions, with an approver and a review date.
- Produces the Safe Harbor evidence (§13402(h) of HITECH) that neutralises breach notification for encrypted lost media.
- Reports deviations and tracks the proposed Security Rule’s “required” state in parallel.
How it maps to HIPAA
The feature supports §164.312(a)(2)(iv) (encryption and decryption), §164.312(e)(2)(ii) (transmission security — encryption), §164.310(d) (device and media controls), §164.306(d) (addressable rationale), and HITECH §13402(h) (safe harbor through encryption).
Where it fits
Encryption is a Security module capability. The policy artefact lives in the free encryption policy template; the asset context comes from Asset Inventory.