Cyberattacks on healthcare organizations are growing, putting personal and identifiable information (PII) at constant risk. That’s why encryption is more important than ever.
Encryption helps protect sensitive data and is a key requirement under HIPAA and HITRUST CSF. With major updates to both frameworks coming in 2025, now is the time to strengthen your encryption strategy.
This blog explores what the new standards mean and how your organization can stay secure and compliant.
Optimizing Data Encryption in Healthcare through Compliance
Organizations operating within or adjacent to healthcare can significantly enhance the security of protected health information (PHI) by adhering to the best practices outlined by regulatory frameworks such as HIPAA and HITRUST CSF.
These frameworks are essential for guiding data encryption efforts to protect PHI from unauthorized access or breaches. Here’s how these frameworks work together to optimize encryption practices:
- Safeguard PHI with HIPAA: Use HIPAA’s guidelines to implement encryption practices that protect protected health information (PHI).
- Enhance Encryption with HITRUST CSF: Leverage HITRUST CSF’s adaptable controls to address emerging cybersecurity threats and strengthen your encryption strategy.
The combination of HIPAA compliance and HITRUST CSF’s extensive, risk-based approach provides a strong foundation for encryption strategies that can help mitigate breach risks. Moreover, this dual-layered approach not only enhances data security but also ensures organizations meet evolving regulatory requirements.
To further strengthen compliance efforts, engaging with a skilled HITRUST CSF compliance advisor can provide valuable guidance. These experts help organizations effectively implement and maintain encryption practices, ensuring long-term security and regulatory adherence.
Data Encryption in Healthcare Using HIPAA
The Health Insurance Portability and Accountability Act (HIPAA) of 1996 establishes standards for securing sensitive PHI.
HIPAA outlines specific requirements for healthcare organizations to implement effective encryption measures, focusing on how PHI is created, processed, stored, transmitted, or otherwise handled. HIPAA is overseen by the U.S. Department of Health and Human Services (HHS) and divides its regulations into four primary rules:
- HIPAA Privacy Rule
- HIPAA Security Rule
- HIPAA Breach Notification Rule
- HIPAA Enforcement Rule
The latest regulatory updates from HHS, especially the proposed 2025 changes, underscore the need for enhanced cybersecurity practices.
The new measures aim to address the increasing cybersecurity threats to PHI, including a call for more robust encryption solutions. Let’s dive into how each of HIPAA’s rules governs encryption.
HIPAA Privacy Rule
The HIPAA Privacy Rule defines the permitted uses and disclosures of Protected Health Information (PHI) by covered entities. It sets standards for how sensitive health information can be shared, stored, and protected.
The Privacy Rule applies to the following covered entities:
- Health Plans: Including health insurance companies, HMOs, and government programs like Medicare.
- Healthcare Providers: Such as doctors, hospitals, pharmacies, and clinics, who provide medical care and services.
- Healthcare Clearinghouses: These entities process nonstandard health information into standard formats for healthcare providers or health plans.
The HIPAA Privacy Rule applies not just to healthcare providers and insurers (covered entities), but also to business associates, people or companies that work with these organizations and handle protected health information (PHI).
These partners must follow the same privacy standards and include HIPAA compliance terms in their contracts.
When PHI Can Be Disclosed:
-
-
To the Individual – Patients or their authorized representatives can request access to their own data.
-
For Healthcare Operations – Including treatment, billing, and administrative functions.
-
With Patient Agreement – If the patient has been informed and agrees or does not object.
-
As Incidental Use – When disclosure happens as part of a permitted activity.
-
For Public Health and Safety – For research, disease control, or public health reporting.
-
With Written Consent – When patients provide signed authorization for other uses.
-
Covered entities are also obligated to disclose PHI in these situations:
- Upon Request of the Subject: The subject of the PHI, or their representative, may request access to their own health data.
- To the U.S. Department of Health & Human Services (HHS): For purposes of compliance investigations, audits, or enforcement actions by the Office for Civil Rights (OCR).
Following the HIPAA Privacy Rule helps organizations handle patient data responsibly while promoting strong data protection practices. When combined with the HIPAA Security Rule, it forms a complete framework for safeguarding health information.
This alignment requires organizations to use strong encryption and other security controls, reducing the chances of data breaches and keeping sensitive patient information safe.
HIPAA Security Rule
The HIPAA Security Rule is crucial for safeguarding electronic PHI (ePHI), and it mandates the use of various safeguards, including data encryption. The rule categorizes safeguards into three main areas:
1. Administrative Safeguards: These are policies and procedures to manage the overall security of ePHI and minimize risks, including:
- Risk Management and Vulnerability Assessment: Identifying and addressing security risks.
- Security Policies and Procedures: Developing comprehensive security policies.
- Workforce Management and Training: Ensuring employees are trained on security procedures and responsibilities.
- Evaluation and Monitoring: Conducting regular reviews and audits to ensure security policies are followed.
2. Physical Safeguards: These protect the physical access to facilities and devices containing ePHI:
- Facility Access Control: Limiting physical access to ePHI locations to authorized personnel.
- Workstation Security: Ensuring workstations with access to ePHI are physically secured.
- Device and Media Control: Proper handling and disposal of devices and media that store ePHI.
3. Technical Safeguards: These are technologies used to secure ePHI during storage, processing, and transmission:
- Access Control: Restricting access to ePHI based on job roles or functions (e.g., authentication, authorization).
- Audit Controls: Maintaining logs of systems and software interacting with ePHI to detect and respond to unauthorized access.
- Integrity Controls: Implementing systems to prevent the unauthorized modification or destruction of ePHI.
- Transmission Security: Ensuring the safe transmission of ePHI, often using encryption protocols to protect data during transmission.
The 2025 updates to the Security Rule propose stronger cybersecurity protocols for electronic PHI, reinforcing encryption as a central measure for preventing unauthorized access.
HIPAA Breach Notification Rule
In the unfortunate event of a breach, the HIPAA Breach Notification Rule outlines the steps covered entities must take, including notifying affected individuals and the HHS. While encryption helps mitigate the severity of a breach by making data unreadable to unauthorized parties, organizations must still report breaches according to the rule’s guidelines. Encryption remains one of the best preventive measures to reduce the impact of data breaches.
HIPAA Enforcement Rule
The Enforcement Rule includes provisions for penalties and corrective actions in case of non-compliance with HIPAA. As cyber threats continue to evolve, the HHS has indicated a greater focus on enforcement, with the potential for more rigorous penalties for failing to implement adequate data encryption solutions. The Department of Justice (DOJ) may also become involved in cases of severe breaches.
How to Optimize Data Encryption in Healthcare Using HITRUST CSF
As healthcare organizations face increasingly sophisticated cyber threats, relying on HIPAA alone may no longer be sufficient to ensure comprehensive data protection.
This is where HITRUST CSF (Common Security Framework) comes into play, offering a more robust and adaptable solution. Specifically, HITRUST CSF serves as an integrated framework that not only aligns with various regulatory standards, including HIPAA, but also provides a risk-based approach to data encryption.
By leveraging this framework, organizations can enhance their security posture, address evolving threats, and maintain compliance with industry regulations more effectively.
What is the HITRUST CSF?
The HITRUST CSF combines multiple cybersecurity requirements from different standards and regulatory frameworks, such as PCI DSS, HIPAA, and others, into a single, comprehensive security framework. The CSF helps organizations navigate complex regulatory landscapes by offering standardized and scalable controls.
The HITRUST CSF framework consists of:
-
Control Categories
There are 19 categories in the latest version of the HITRUST CSF, not 14. These categories cover various cybersecurity domains like Access Control, Risk Management, and Incident Response, aligning with other regulatory frameworks but also providing a more integrated and comprehensive approach.
-
Control Objectives
The framework now includes 60 control objectives, which help define specific goals within each control category. These objectives support cybersecurity practices at a more granular level and help guide organizations through their compliance journey.
-
Control References
There are 230+ control references (previously listed as 155) across different regulatory requirements, standards, and industry best practices. These references break down into specific activities or policies organizations should implement to achieve the broader control objectives.
By implementing the HITRUST CSF, organizations align encryption practices with industry standards and best practices while significantly reducing the risks associated with PHI breaches. Moreover, as cyber threats continue to evolve, organizations must take a proactive approach to data security.
With HITRUST CSF’s adaptive controls, they can continuously adjust their data protection measures in real-time, effectively staying ahead of emerging risks and maintaining compliance in an ever-changing threat landscape.
HITRUST CSF Assurance Program
The HITRUST CSF Assurance Program helps organizations validate their data encryption practices by offering comprehensive assessment processes, including self-assessments and external audits.
The HITRUST CSF program helps healthcare organizations prove their commitment to protecting patient data through strong encryption and security practices.
Here’s how it works:
-
Self-Assessments
Identify risks and gaps in:-
Data encryption tools
-
Compliance with HIPAA, PCI DSS, and other standards
-
Risk and vulnerability reporting
-
-
CSF-Validated Assessments
Performed by certified HITRUST assessors and include:-
Onsite interviews about encryption practices
-
Policy and documentation reviews
-
Testing of encryption systems and tools
-
-
CSF-Validated Assessments with Certification
Provide formal proof of:-
Strong risk management practices
-
Alignment with healthcare encryption standards
-
Implementation of key security controls
-
By achieving HITRUST CSF certification, healthcare organizations can demonstrate to partners, vendors, and customers that they are fully compliant with stringent encryption standards.
HITRUST CSF Control Maturity Assessment
Healthcare organizations seeking HITRUST CSF compliance must actively assess the maturity of CSF security controls. To do so effectively, they should emphasize key frameworks like NIST SP 800-53 and the NIST Cybersecurity Framework (NIST CSF), which now integrate seamlessly into the HITRUST CSF framework.
Additionally, the landscape of information security management has shifted. The Program Review of Information Security Management Assistance (PRISMA) is no longer the primary reference for this, rather, NIST controls have emerged as the recognized standard for ensuring robust information security management.
Assessment of control maturity helps organizations assess and optimize data encryption in healthcare, specifically for encrypting Protected Health Information (PHI) both at rest and in transit.
To meet HITRUST CSF compliance for healthcare data encryption, the following control maturity levels must be achieved:
-
Policy
– Controls must address data encryption policies and include:
- Documentation of up-to-date policies
- Ongoing encryption risk assessment and monitoring
- Coverage of all data encryption systems and operations
- Regular updates to encryption policies and approval processes
- Clear security management structure for all data encryption practices
-
Procedure
– Controls must ensure effective data encryption procedures by:
- Defining and updating data encryption practices through security policies
- Clearly outlining workflows and step-by-step encryption guidelines
- Defining roles and responsibilities of all involved security personnel
- Establishing communication and escalation procedures related to encryption
- Providing clear documentation of how encryption is rigorously applied
-
Implemented
– Controls must streamline encryption implementation, ensuring:
- Consistent deployment of encryption procedures across the organization
- Training for staff involved in data encryption practices
- Validation of encryption controls through testing and initial assessments
-
Measured
– Controls must assess the effectiveness of encryption by:
- Routine testing to evaluate encryption effectiveness and security robustness
- Ongoing validation of encryption practices against defined policies
- Independent audits to assess data encryption performance organization-wide
- Incident assessments to identify any gaps or vulnerabilities in encryption
- Re-evaluating threats to adapt threat intelligence accordingly
- Monitoring and reporting on encryption effectiveness, including established security metrics
-
Managed
– Encryption controls must be continuously managed to ensure:
- Corrective action plans are implemented to address encryption gaps
- Ongoing evaluation and improvement of encryption policies and procedures
- Integration of encryption security within the organizational budget and planning processes
- Benchmarked internal threat intelligence against industry-recognized threat databases
- Development of cost-effective encryption solutions and continuous optimization
- Evidence of encryption and overall security program effectiveness
By continuously assessing these maturity levels and incorporating emerging cybersecurity best practices, organizations can optimize their encryption practices, stay compliant, and protect PHI from evolving cyber threats.
Optimizing Data Encryption with the MyCSF Tool
To further enhance data encryption practices, organizations can leverage the MyCSF platform, developed by HITRUST. This powerful tool not only streamlines the self-assessment and certification processes but also provides several key features that make it easier to identify and address encryption gaps, including:
- Corrective Action Plans (CAPs) to proactively manage risks related to encryption.
- Simplified reporting of encryption compliance, making it easier to communicate with regulators and stakeholders.
- Real-time tracking of HITRUST CSF assessments and corrective measures to ensure continuous improvement.
By utilizing the MyCSF platform, healthcare organizations can systematically optimize their data encryption strategies. Furthermore, this powerful tool provides the flexibility needed to adapt to emerging threats and regulatory updates. More importantly, it enables organizations to stay ahead of evolving regulatory requirements while maintaining strong compliance in an increasingly complex cybersecurity landscape.
Strengthen Healthcare Data Encryption and Protect PHI
Encrypting healthcare data is essential to keeping sensitive patient information safe from growing cyber threats. With new 2025 regulations on the horizon, now is the time for healthcare organizations to upgrade their encryption strategies.
By aligning with updated standards like HIPAA and HITRUST CSF—and working with experienced compliance advisors—organizations can strengthen the confidentiality, integrity, and availability of PHI.
Protect your organization from costly HIPAA violations, download our HIPAA Checklist today to ensure you’re fully compliant