HIPAA transmission security, 164.312(e), asks you to guard against unauthorized access to ePHI sent over an electronic network. It is not limited to the public internet. Internal service calls, message queues, file transfers and device links all count, so inventory every path, then decide on encryption and integrity for each.
What the standard says
The standard requires technical security measures against unauthorized access to ePHI being transmitted over an electronic network. It has two addressable specifications: integrity controls, so transmitted ePHI is not improperly modified without detection, and encryption, whenever deemed appropriate.
"Electronic network" is broad. A flat internal network is still a network.
Build the path inventory
List every route that carries ePHI.
- Patient and staff browsers to web apps.
- Mobile apps to APIs.
- Partner and payer connections, such as FHIR or HL7 interfaces.
- Service to service calls inside your cloud.
- Database connections from application servers.
- File transfers, including SFTP drops and report exports.
- Medical device and imaging links.
- Email and messaging that might carry ePHI.
Decide per path
For each route, record the protection and the reason. Common answers:
- Public routes: TLS with current configurations. The FHIR security page says production exchanges should use TLS and follow current IETF best practice.
- Internal service calls: TLS between services, or a mesh that provides it, with certificates that rotate.
- Database links: enforce TLS on the connection, not just allow it.
- Legacy interfaces: wrap them in an encrypted tunnel or move them to an isolated segment, and document it.
- Email: avoid ePHI in ordinary email, or use a secure delivery method.
Integrity is the quiet half
Encryption in transit usually gives you integrity as well, since tampering breaks the session. For file transfers, add checksums or signatures so a changed file is noticed. For message interfaces, validate and log rejections.
Trust the config, then test it
Do not rely on a diagram. Scan your own endpoints for weak protocols, expired certificates and plain text ports. Check that headers and error messages do not reveal server details, which FHIR guidance also advises.
Safeguard's asset discovery can help find hosts and services you forgot, and its free scan at https://gold.safeguard.sh/scan can check a dependency list. Neither replaces a network review.
See also DICOM and encryption.
Quick check
Does transmission security apply inside my own network?
The standard covers ePHI sent over any electronic network, so internal paths should be assessed and documented.
Sources
Last reviewed: 19 October 2026.
