164.312(a)(2)(iv) Encryption and Decryption (Addressable)
Technical safeguard · Addressable
The requirement as we hold it
Encryption and Decryption (Addressable). Implement a mechanism to encrypt and decrypt ePHI. NIST recommends FIPS 140-validated cryptography, encryption at rest for all ePHI stores, and key management aligned to SP 800-57.
The examiner asks
- Show me that ePHI is encrypted at rest and how the keys are managed.
- Which stores hold ePHI unencrypted, and why is that appropriate?
Evidence to bring
- the encryption configuration
- the key management plan
Source: 164.312(a)(2)(iv) at eCFR. Our statement of the clause, not the instrument verbatim.