HIPAA encryption requirements can be confusing because the current Security Rule treats encryption of electronic protected health information (ePHI) as an addressable implementation specification. That does not allow an organization to skip the analysis.
Organizations must determine whether encryption is reasonable and appropriate based on their risks and document the decisions they make.
The assessment becomes more complicated once a medical record leaves its source system. Downloads, temporary files, system handoffs, portal transfers, and final delivery can create additional control points.
For release of information teams, the practical rule is simple: evaluate encryption across the path of the record, not just at the application level.
This article provides general information about HIPAA requirements and is not legal advice.
Table of contents
Does HIPAA Require Medical Records to Be Encrypted?
The HIPAA Security Rule requires regulated entities to use reasonable and appropriate administrative, physical, and technical safeguards to protect ePHI.
Under 45 CFR § 164.312, encryption is an addressable implementation specification under both access control and transmission security. Transmission security itself is a required standard; encryption is an addressable specification within it.
Checking whether a platform uses encryption does not satisfy HIPAA encryption requirements by itself. The organization should be able to show what it evaluated, which risks it identified, and why its safeguards are appropriate.
What Does “Addressable” Mean Under HIPAA?
When an addressable implementation specification is reasonable and appropriate, the organization must implement it.
If it is not, the organization must document that determination and implement an equivalent alternative when one is reasonable and appropriate. If the organization can otherwise meet the underlying standard, it may choose neither measure, but it must document the rationale.
That required evaluation and documentation process is why “addressable” should not be treated as permission to ignore the safeguard.
Could HIPAA Encryption Requirements Change?
Yes. HHS has proposed changes that would remove the current distinction between required and addressable implementation specifications and require encryption of ePHI at rest and in transit, subject to limited exceptions.
The proposal also includes more specific technology inventory, network mapping, and risk analysis requirements.
Those provisions remain proposed. The current Security Rule remains in effect while rulemaking continues.
What Is the Difference Between HIPAA Encryption at Rest and in Transit?
Encryption at rest protects ePHI while it is stored. Encryption in transit protects ePHI while it moves between systems, networks, organizations, or users.
A medical record can move between those states several times during one release request.
| Question | Encryption at Rest | Encryption in Transit |
| What does it protect? | Stored ePHI | ePHI moving between locations |
| Medical record examples | Databases, backups, cloud storage, laptops, downloaded records | APIs, integrations, portals, file transfers, electronic delivery |
| Encryption status under the current rule | Addressable | Addressable |
| Common release of information blind spot | Backups, exports, local downloads | System handoffs and final delivery |
What Is Encryption at Rest?
One common operational gap is checking the primary application and stopping there.
A downloaded record packet may no longer sit behind the same controls as the source application. The same concern applies to exports, temporary files, backups, endpoints, and other copies of ePHI.
The review should identify where those copies can exist and what protects each one.
For Breach Notification Rule purposes, HHS identifies encryption processes consistent with NIST SP 800-111 as one method for rendering stored ePHI unusable, unreadable, or indecipherable to unauthorized individuals.
What Is Encryption in Transit?
For release of information teams, the practical issue is the handoff.
The provider may control the EHR, a business associate may control the release platform, and the recipient controls what happens after receipt. Each transition can change the control environment.
The Security Rule requires transmission security measures to guard against unauthorized access to ePHI sent over electronic networks. HIPAA does not prescribe one transmission technology or a specific TLS version.
Pay particular attention to final delivery, where the record often leaves systems the provider or its business associate directly controls.
What If a Patient Requests Records by Unencrypted Email?
HIPAA’s Right of Access creates an important distinction.
An individual generally has a right to receive PHI through an unsecured method such as unencrypted email when the information is readily producible that way and the method does not create an unacceptable security risk to PHI on the covered entity’s own systems.
When the individual chooses that method, the covered entity must provide a brief warning about the security risk and confirm that the individual still wants to proceed.
The organization must still use reasonable safeguards while fulfilling the request, such as entering the correct destination email address.
This is a specific Right of Access scenario under 45 CFR § 164.524, not general permission to use unsecured transmission whenever convenient.
That distinction matters when emailing medical records under HIPAA because recipient validation, release scope, safeguards, and documentation still need to be controlled throughout the release.
What Encryption Standards Support HIPAA Compliance?
HIPAA encryption requirements do not mandate AES-256 or another single encryption algorithm. The Security Rule is technology neutral, so an algorithm alone does not make a system HIPAA compliant.
For Breach Notification Rule purposes, HHS points to recognized technical standards for rendering ePHI unusable, unreadable, or indecipherable. That guidance includes NIST SP 800-111 for data at rest.
Those references do not make NIST guidance itself mandatory under the Security Rule. HHS separately confirms that regulated entities are not required to use the NIST guidance documents it references.
Compliance teams should understand where the controls apply, who owns them, and what evidence supports the organization’s risk decision.
When a vendor says its platform is encrypted or HIPAA compliant, ask what that claim actually covers. An encryption label does not tell you whether downloads, integrations, temporary files, or delivery channels receive the same protection.
Why Does Encryption Key Management Matter?
Compliance teams do not need to manage a vendor’s encryption keys. They do need enough visibility to understand who controls decryption and how access is governed.
They should also understand whether the vendor appropriately separates the means of decryption from the protected information. HHS recommends keeping the confidential process or key used for decryption separate from the data it protects.
That distinction becomes especially important after a security incident.
How Does Encryption Affect HIPAA Breach Notification?
The HIPAA Breach Notification Rule addresses breaches of unsecured PHI.
Qualifying encryption can render ePHI unusable, unreadable, or indecipherable to unauthorized individuals when the confidential process or key needed for decryption has not also been compromised.
HHS describes ePHI encrypted consistently with its guidance as falling within the breach notification “safe harbor”.
If the encryption does not meet the applicable criteria or the decryption key was also compromised, that safe harbor may not apply. Encryption therefore matters to breach analysis, but it does not eliminate the need to evaluate the incident.
Why Isn’t Encryption Alone Enough to Secure Medical Record Release?
A medical record can be encrypted and still be disclosed improperly.
Encryption can protect a record during transmission without confirming the correct recipient, date range, or disclosure scope. Encryption at rest also does not determine whether a staff member should have access.
The Security Rule separately addresses access controls, audit controls, integrity, authentication, and transmission security. Those controls continue to matter throughout the release workflow.
For release of information teams, security and release accuracy have to work together. Every disconnected system, manual download, delivery step, and vendor handoff creates another point the organization has to understand and govern.
What Should Compliance Officers Verify in a Secure Medical Records Release Workflow?
HIPAA encryption requirements are easier to evaluate when the review starts with the data flow. Map where the record is stored, where copies appear, and every point where responsibility changes hands.
HIM can map the release path. Health IT or Security can validate the technical controls. Compliance can document the risk analysis, responsibilities, and resulting decisions.
Then work through the workflow:
- Trace the record beyond the EHR. Follow it through integrations, release platforms, portals, downloads, and final delivery.
- Look for copies outside the primary system. Temporary files, exports, endpoints, and backups may sit under different controls.
- Examine every handoff. Determine what protects the record when responsibility moves between systems, vendors, and recipients.
- Review transmission methods. Include portals, APIs, file transfers, email, remote access, and other delivery channels.
- Check access and auditability. Confirm how users and systems reach ePHI and whether the team can reconstruct relevant activity.
- Ask for evidence, not labels. Confirm what supports a vendor’s security claims and where your responsibilities begin.
- Map vendor responsibility. Identify vendors that handle ePHI and confirm required business associate relationships.
- Document and revisit the decision. Record the rationale and when workflow changes should trigger another review.
Encryption does not eliminate business associate responsibilities. A cloud service provider that maintains ePHI on behalf of a regulated entity remains a business associate even if the provider lacks the decryption key.
Required Security Rule documentation generally must be retained for six years after the later of its creation or the date it was last in effect. That six-year requirement applies to required Security Rule documentation, not the underlying clinical record.
HIPAA does not establish a general medical record retention period.
A compliance team should be able to reconstruct the record’s path without piecing together answers from several systems, inboxes, and vendors.
Review Your HIPAA Release Workflow With ChartRequest
An encryption review can also surface release workflow gaps.
Downloads, email handoffs, disconnected systems, and manual delivery steps create additional control points after a record leaves the EHR.
We help healthcare organizations bring release of information into a more consistent digital workflow so HIM and compliance teams have fewer fragmented handoffs to manage and a clearer process to review.
If your review is uncovering gaps between systems, staff, vendors, or delivery methods, review your release of information workflow with ChartRequest. We can help identify where a more consistent process could reduce avoidable control gaps or manual work.
Frequently Asked Questions
Is Encryption Required for HIPAA Compliance?
Under current HIPAA encryption requirements, encryption is addressable rather than universally required. Regulated entities must determine whether it is reasonable and appropriate and document the decision they make.
Does HIPAA Require AES-256 Encryption?
No. HIPAA does not specifically mandate AES-256 or another single encryption algorithm. The Security Rule is technology neutral so organizations can select safeguards appropriate to their risks and environments.
Does HIPAA Require Email Containing PHI to Be Encrypted?
Not in every circumstance. Under the HIPAA Right of Access, an individual may request records through an unsecured method such as unencrypted email when the information is readily producible that way and the method does not create an unacceptable security risk to the covered entity’s systems. The covered entity must warn the individual about the transmission risk before proceeding.
Does Encryption Mean a HIPAA Breach Does Not Have to Be Reported?
Not automatically. Qualifying encryption can place ePHI within HHS’s breach safe harbor when the decryption process or key remains secure. The organization still needs to evaluate the incident because compromised keys, inadequate encryption, or other facts can change the notification analysis.
