← HIPAA · Technical safeguards
164.312(a)(2)(iv) — Encryption and decryption at rest (A)
Requirement
Implement a mechanism to encrypt and decrypt electronic protected health information. Where encryption is not implemented, the entity must document why it is not reasonable and appropriate and what equivalent alternative measure is in place.
What the engine looks for
Every group below must be satisfied — by an affirmative statement, not a plan, a hedge or a denial — for the control to count as covered. A term ending in … matches any word it begins. Supporting terms do not change the verdict — they raise confidence and distinguish a policy that names a mechanism from one that gestures at a category.
Finding any of these outranks coverage — a policy that admits the gap is worse than silence.
Equivalent controls elsewhere
Matched on shared topics. Satisfying this control usually moves these too.
| Framework | Control | Title | Shared topics |
|---|---|---|---|
| PCI DSS 4.0.1 | 3.5 | PAN is rendered unreadable wherever it is stored | encryption-at-rest key-management |
| NIST CSF 2.0 | PR.DS-01 | Confidentiality, integrity and availability of data at rest | encryption-at-rest key-management |
| ISO 27001 | A.8.24 | Use of cryptography | encryption-at-rest key-management |
| CCPA/CPRA | 1798.100(e) & 1798.150 | Reasonable security procedures | encryption-at-rest |
| ISO 27001 | A.7.10 | Storage media | encryption-at-rest |
| ISO 27001 | A.8.1 | User end point devices | encryption-at-rest |
| PCI DSS 4.0.1 | 3.6-3.7 | Cryptographic key management | key-management |
| GLBA | 314.4(c)(3) | Encryption of customer information in transit and at rest | encryption-at-rest |