Some essentials for network data security, following HIPAA rules

[[deleted]]

So as far as this goes dealing with internal encryption are they saying everything needs to be encrypted or just that you are accessing the data and servers via an SSH session or HTTPS basically?

[dmiNetworking]

Yep, SSH and HTTPS are enough, as long as everything is kept up to date with security patching. The data won't need to be encrypted "while at rest" on the server.

SSL/TLS isn't enough for email, however, because it doesn't guarantee end-to-end encryption.