Computer-Assisted Coding Vendor Encryption Policy Guide

How should vendors encrypt patient information at rest and in transit?

Ask how the vendor protects electronic protected health information (ePHI) throughout its full lifecycle—not only in the primary database. Encryption at rest should cover relevant databases, storage volumes, temporary files, caches, replicas, exports, and backups. Encryption in transit should protect data moving between your organization, the vendor’s service, and any subcontractors or connected systems.

For internet connections, request details about the vendor’s TLS configuration and how it prevents or detects insecure connections. A virtual private network (VPN) can help protect certain network connections, but it does not by itself secure data after it reaches an endpoint or address every integration and transfer method. Ask the vendor to explain which data paths use a VPN, which use other protected protocols, and what safeguards apply at each endpoint.

HIPAA requires regulated entities to protect ePHI with reasonable and appropriate safeguards, but encryption is an addressable implementation specification—not an unconditional, stand-alone mandate for every situation. An organization must assess whether encryption is reasonable and appropriate; if it is not, the organization must document its decision and consider an equivalent alternative measure when reasonable and appropriate. See HHS guidance on encryption under the Security Rule and the HHS HIPAA Security Rule summary.

What encryption standards should coding vendors disclose?

HIPAA does not prescribe one encryption algorithm, product, or protocol. Ask the vendor to name the algorithms, protocols, cryptographic libraries, and configurations it actually uses for each relevant data flow and storage environment. The vendor should distinguish deployed controls from planned upgrades and explain how it addresses outdated or weak configurations.

As a procurement baseline, you can ask whether the vendor supports modern TLS—such as TLS 1.2 or TLS 1.3—with secure configuration for data transmission, and uses a recognized strong encryption algorithm such as AES for stored data. NIST publishes guidance for TLS implementations and defines AES as a standard for protecting electronic data; these are useful technical references, not HIPAA-mandated vendor settings. See NIST guidance on TLS implementations and NIST’s AES standard.

Ask for enough detail to evaluate whether encryption is applied consistently, including connections to subcontractors and support tools. A statement such as “HIPAA compliant encryption” is not specific evidence of an algorithm, configuration, scope, or effective safeguard.

How can you assess vendor access controls and security procedures?

Confirm that access to ePHI is limited to authorized users and appropriate to their job functions. Ask about unique user accounts, role-based permissions, multifactor authentication, privileged administrator access, timely removal of access when roles change, and periodic access reviews. Shared accounts can make it harder to identify who accessed records or performed an action.

Request an explanation of how the vendor logs and reviews access to patient records, coding activity, administrative actions, and security events. Ask how long relevant logs are retained, who can review them, and how suspicious activity is investigated. HIPAA includes access-control, audit-control, and authentication requirements; see the HHS summary of the Security Rule’s safeguards.

Ask whether the vendor uses intrusion detection systems or comparable monitoring to identify suspicious network or system activity, and how it responds to alerts. These are security assessment questions, not a claim that a particular tool by itself establishes compliance. Also review the vendor’s incident response procedures, workforce security practices, and process for reporting incidents under the business associate agreement (BAA).

What safeguards protect integrations and data transfers?

Map every path through which coding data enters or leaves the service, including electronic health record interfaces, application programming interfaces, file transfers, vendor support channels, and subcontractor connections. For each path, ask what authentication, encryption, integrity checks, and monitoring are in place. The vendor should explain how it prevents unauthorized access and detects unexpected alteration or incomplete transfers.

Ask whether integrations use authenticated, encrypted connections and whether credentials, tokens, and certificates are protected, rotated, and revoked when no longer needed. If the vendor uses a VPN, clarify which systems and transfer routes it protects; do not assume it covers every connection or protects data after delivery to a device or system.

HHS says ePHI may be sent over an electronic open network when it is adequately protected, and that regulated entities must assess appropriate safeguards for their circumstances. See HHS guidance on transmitting ePHI over electronic networks.

How should downloads, backups, and encryption keys be managed?

Prefer workflows that let coders work within the vendor’s controlled application rather than download patient records to local computers. If downloads are necessary, ask whether the organization can restrict them and require approved, encrypted devices with access controls, endpoint protection, and remote-wipe capability. Establish rules for local copies, removable media, printing, and secure deletion when files are no longer needed.

Ask how backups are encrypted, who can access them, where they are stored, and how restoration is tested. Confirm that backup copies and snapshots receive protections comparable to the production environment, and that the vendor’s retention and deletion practices match contractual requirements and your organization’s policies.

Encryption key management matters as much as the encryption algorithm. Ask who controls the keys, how they are stored and access-restricted, how key access is logged, and how keys are rotated, revoked, and recovered. Where the vendor manages keys, clarify the separation of duties and what happens to keys and encrypted data when the contract ends. NIST provides guidance on cryptographic key management in its key-management resources.

What evidence should you request during a vendor security assessment?

Request evidence that maps the vendor’s stated controls to the actual coding service and the ePHI it handles. Useful materials may include a current security overview, encryption and key-management documentation, network or data-flow diagrams, access-control and logging descriptions, backup and restoration procedures, and a summary of recent independent security testing. Ask about the scope and date of any assessment, identified exceptions, and remediation status.

Also review the proposed BAA, subcontractor arrangements, incident-notification commitments, data-retention terms, and return-or-destruction procedures at termination. HHS explains that the HIPAA Rules require appropriate contractual assurances from business associates, but do not generally require a vendor to provide security documentation or permit customer audits; customers may request those additional assurances through contracts or other agreements based on their risk analysis. See HHS guidance on business associate security documentation and audits and HHS sample business associate agreement provisions.

Treat certificates, attestations, and questionnaires as supporting evidence rather than proof that every safeguard is effective in your environment. In summary, assess encryption across storage and transfer, verify access and operational controls, and document how the vendor’s safeguards fit your organization’s risk analysis and contractual requirements.

FAQs.

Does HIPAA require encryption of ePHI at rest and in transit?

HIPAA makes encryption an addressable implementation specification, not a universal requirement to encrypt every instance of ePHI in every circumstance. Regulated entities must assess whether encryption is reasonable and appropriate; if it is not, they must document the decision and consider an equivalent alternative measure when appropriate. The Security Rule still requires safeguards for ePHI at rest and in transit. See HHS encryption guidance.

What encryption standard should a computer-assisted coding vendor use for data transmission?

HIPAA does not name a specific transmission protocol. As a practical procurement baseline, ask the vendor to support modern TLS, such as TLS 1.2 or TLS 1.3, with a secure configuration, and request documentation showing how it is applied to each data path. NIST’s TLS guidance is a technical reference, not a HIPAA-specific mandate. See NIST TLS implementation guidance.

Should coders download patient records to local computers?

Usually, avoid local downloads when coders can complete their work securely in the vendor’s controlled application. If downloads are necessary, limit them to authorized users and approved encrypted devices, control access and retention, and securely remove files when they are no longer needed. Your organization should set the policy based on its risk analysis and workflows.

What evidence can a vendor provide to demonstrate encryption safeguards?

A vendor can provide descriptions of encryption algorithms and protocols, data-flow diagrams, key-management procedures, access and logging controls, backup safeguards, and appropriately scoped independent assessment results. Ask for evidence that applies to the specific service and ePHI involved, including any subcontractors. HIPAA does not generally require vendors to provide customers with security documentation, so request access and audit terms in the BAA or another contract when needed for your risk review. See HHS guidance on vendor security documentation.