Implement Encryption and Decryption

[suhasramanand]

Implement a mechanism to encrypt and decrypt ePHI when deemed appropriate.

Acceptance criteria

• Minimum encryption standard: AES-256 for data at rest
• Minimum encryption standard: TLS 1.3 for data in transit
• Key rotation required every 90 days

---

Source: § 2.1.4

Covered entities SHOULD implement a mechanism to encrypt and decrypt ePHI when deemed appropriate.