Requirement
164.312(e)(1) - Implement technical security measures to guard against unauthorized access to electronic protected health information that is being transmitted over an electronic communications network.
Implementation Specifications
Integrity Controls (Addressable) - 164.312(e)(2)(i)
Requirement: Implement security measures to ensure that electronically transmitted electronic protected health information is not improperly modified without detection until disposed of.
Encryption (Addressable) - 164.312(e)(2)(ii)
Requirement: Implement a mechanism to encrypt electronic protected health information whenever deemed appropriate.
Explanation
In order to determine the technical security measures to implement to comply with this standard, covered entities must review the current methods used to transmit EPHI. For instance, is EPHI transmitted through email, over the Internet, or via some form of private or point-to-point network? Once the methods of transmission are reviewed, the covered entity must identify the available and appropriate means to protect EPHI as it is transmitted.
