Part of the Healthcare operations glossary.
Encryption in transit protects data while it travels between devices and servers. Encryption at rest protects data while it is stored. A clinic needs both, and the HIPAA Security Rule addresses both as safeguards a practice must implement or formally account for.
Definition
Encryption in transit protects data moving across a network; encryption at rest protects data stored on disks, servers or phones.
Data needs protection while it travels and while it is stored. Protecting one state does not cover the other.
- In transit: When a browser or app sends a message, TLS (Transport Layer Security) scrambles it on the way, so anyone intercepting the connection sees unreadable data.
- At rest: When a file sits on a server or a laptop drive, encrypted storage keeps it unreadable to anyone who copies the disk without the key.
In practice at a clinic or small practice
In transit. The front desk posts a staff message about a schedule change, or a nurse uploads a document from a phone between appointments. Encryption in transit protects that data as it crosses the clinic Wi-Fi or a cellular network. Staff rarely see this happen. The visible signs are the padlock icon and "https" in the browser address bar.
At rest. The office manager's laptop, the shared drive and a vendor's servers all hold stored files. With encryption at rest, a stolen laptop or a copied disk is unreadable without the key. In daily work, this depends on a few habits:
- Use a passcode on every phone.
- Let IT set up full-disk encryption on laptops.
- Ask each vendor how it protects stored data before you put work files in its system.
Not to be confused with
End-to-end encryption. In end-to-end encryption, only the sender's and the recipient's devices hold the keys, so the service provider cannot read the content. Encryption in transit plus encryption at rest is a different model. The data is protected on the network and on disk, but the provider's servers can still process it. For example, Chanty encrypts data in transit with TLS 1.2+ and encrypts file storage. It does not describe itself as end-to-end encrypted. See how Chanty handles security and the BAA.
"HIPAA compliant." Encryption is one safeguard among several. It does not make a tool or a practice compliant on its own. A business associate agreement (BAA), access controls, and staff policies and training still apply.
What the rules say
The HIPAA Security Rule addresses encryption of electronic protected health information (ePHI) in two places:
| State | Where it appears | Status |
|---|---|---|
| At rest (stored ePHI) | Access control standard | Encryption and decryption is an addressable implementation specification (45 CFR 164.312(a)(2)(iv)) |
| In transit (transmitted ePHI) | Transmission security standard | Encryption is an addressable implementation specification (45 CFR 164.312(e)(2)(ii)) |
"Addressable" does not mean optional. The practice must either implement the specification, or document why it is not reasonable and what equivalent alternative it uses instead (45 CFR 164.306(d)(3)). For the full distinction, see addressable vs required safeguards.
Breach notification. Encryption also matters after an incident. Under 45 CFR 164.402 and the HHS Guidance to Render Unsecured Protected Health Information Unusable, Unreadable, or Indecipherable to Unauthorized Individuals, PHI encrypted consistent with that guidance is not "unsecured PHI," so the loss of properly encrypted data may not be a reportable breach. This depends on the encryption meeting that guidance and the keys not being compromised. A lost laptop is not automatically a non-event because it was encrypted.
Where the terms come from. HIPAA does not define "in transit" and "at rest." These are industry and NIST terms. The HHS breach guidance points to NIST publications for both, including SP 800-111 for stored data and SP 800-52 and SP 800-77 for data in transit.
Possible changes. HHS has proposed updates to the Security Rule, including a change that would make encryption required rather than addressable. Check HHS for the current status of that rulemaking. Until a final rule changes it, treat encryption as an addressable specification that every practice must implement or document an equivalent alternative for.
Related reading
- HIPAA Security Rule: the administrative, physical and technical safeguards for ePHI, including encryption.
- Addressable vs required safeguards: what a practice must do when a specification is addressable.
- Breach Notification Rule: when a loss of PHI must be reported, and how encryption affects that.
Where Chanty fits. chanty.health is published by Chanty, a team chat for clinic staff with a signed BAA from the Business plan. If your team still coordinates in personal group chats, see how HIPAA-compliant staff chat works or start free.