Glossary
Encryption in transit
Also called: TLS encryption, data-in-transit encryption
In one sentence
Protecting data while it travels between devices or across the internet, so it can’t be read or altered on the way.
Encryption in transit protects information as it moves: from a browser to a website, from your email server to someone else’s, from a laptop at home to a file in the cloud. The standard technology is TLS (transport layer security) — the padlock in your browser’s address bar. A VPN adds another encrypted tunnel on top.
Most cloud services encrypt traffic by default, but there are gaps worth knowing. Ordinary email between two different organizations is usually encrypted with TLS when both servers support it, but not always, and the message sits readable in each mailbox at the other end. That’s why practices sending patient details to outside parties should use a dedicated encrypted-message option rather than relying on plain email.
For HIPAA, transmission security is one of the Security Rule’s technical safeguards, and encryption is the way most practices meet it. Insecure leftovers to watch for: old fax-to-email services, file transfers over FTP, scanners sending to email without encryption, and staff texting patient details from personal phones.
Example: a medical office sends referral letters by email. Instead of sending attachments in plain email, staff use Microsoft Purview Message Encryption (included in some Microsoft 365 plans), so the specialist receives a protected message. Read HIPAA-compliant email encryption for the options, and see encryption at rest for protecting stored data.
Related terms
- Encryption at restScrambling stored data — on laptops, servers, phones or in the cloud — so it’s unreadable to anyone without the key.
- VPN (virtual private network)An encrypted tunnel across the internet that lets a remote device connect to your office network as if it were plugged in at the office.
- ePHI (electronic protected health information)ePHI is protected health information that is created, stored, received or sent in electronic form — the data the HIPAA Security Rule exists to protect.
- DLP (data loss prevention)Tools and policies that spot sensitive information — like Social Security numbers or patient records — and stop it from being shared where it shouldn’t go.
- HIPAA Security RuleThe HIPAA Security Rule is the federal regulation that sets the administrative, physical and technical safeguards healthcare providers and their vendors must use to protect electronic patient information.