Patient portal still allowing TLS 1.0
External scan finds outdated TLS on the portal. SC-8 hardening disables legacy protocols before assessors — and attackers — exploit them.
Transmission Confidentiality and Integrity
High Risk
Moderate
Medium Cost
SC-8 requires protecting the confidentiality and integrity of transmitted information. For healthcare that means TLS (or equivalent) for EHR web access, APIs, VPN tunnels, secure email/portal alternatives, and partner interfaces — so eavesdroppers cannot read or undetectably alter ePHI on the wire.
Control Objective
Ensure ePHI and sensitive credentials crossing networks are encrypted and integrity-protected using approved cryptography and configurations.
Implementation Guidance
- Inventory transmission paths that may carry ePHI: patient portal, EHR, telehealth, VPN, email, sFTP, HL7/FHIR, cloud APIs, backup replication.
- Mandate TLS 1.2+ (prefer 1.3) for web/API paths; disable weak ciphers/protocols.
- Use VPN or private links for administrative and partner channels that need network-level protection.
- Replace cleartext legacy interfaces or encapsulate them in TLS/VPN with compensating monitoring if temporary.
- Protect integrity with TLS, message signing, or checksums appropriate to the protocol.
- Manage certificates centrally; monitor expiry.
- Prefer secure messaging/portals over unencrypted email for ePHI.
- Test external sites with SSL scanners and fix findings.
Real-World Use Cases
How this control shows up in healthcare and HIPAA-covered environments.
Lab HL7 over cleartext VPN-less link
An old point-to-point interface sent results unencrypted across a shared network. SC-8 project wraps the channel in TLS or moves it to a private circuit.
Clinicians emailing PHI
Secure email gateway + portal delivery implements transmission protection and reduces cleartext PHI in ordinary SMTP.
Best Practices
- TLS 1.2+ everywhere feasible.
- Certificate lifecycle management and monitoring.
- Ban cleartext admin protocols (telnet, unencrypted RDP over WAN).
- Secure email/portal for ePHI.
- Document exceptions with expiry.
- Align with SC-13 cryptographic module guidance.
Common Gaps & Violations
- Mixed-content EHR modules falling back to HTTP.
- Expired certificates causing insecure bypasses.
- Cleartext FTP for claims or images.
- Partner interfaces 'temporary' cleartext for years.
- Emailing spreadsheets of patients without encryption.
Required Documentation
- Transmission security / encryption-in-transit standard
- Inventory of ePHI transmission paths
- TLS/VPN configuration baselines
- Certificate management procedure
- Exception register for legacy cleartext links
How to Test & Validate
- SSL/TLS scan patient portal and EHR URLs.
- Verify VPN crypto settings meet standard.
- Sample partner interfaces for encryption.
- Confirm email/portal controls for ePHI messages.
- Check certificate expiry monitoring alerts.
Audit Considerations
HIPAA transmission security is addressable but expected for internet paths carrying ePHI. Show configs and scans, plus how exceptions are managed.
HIPAA Mapping
How this NIST control supports HIPAA Security Rule expectations.
- 164.312(e)(1) Transmission Security — guard against unauthorized access to ePHI transmitted over electronic networks.
- 164.312(e)(2)(i) Integrity Controls — ensure electronically transmitted ePHI is not improperly modified.
- 164.312(e)(2)(ii) Encryption — addressable encryption of ePHI in transit.
- 164.306 General rules — risk-based implementation still documented.
Compliance Tips
- Maintain a living diagram of every ePHI transmission path.
- Put certificate expiry in the NOC/alert queue.
- Prefer portals over encrypted ZIP email habits when possible.
Frequently Asked Questions
Is VPN enough if internal EHR is HTTP?
VPN helps on untrusted networks, but modern practice encrypts application sessions too (TLS) end-to-end where possible.
Does SC-8 cover backups to the cloud?
Yes — replication/transmission of backup data containing ePHI needs confidentiality and integrity protection.
How does SC-8 relate to SC-13?
SC-8 requires protecting transmissions; SC-13 addresses the cryptographic protection mechanisms used to do so.
References & Resources
- NIST SP 800-53 Rev. 5 — SC-8
- NIST SP 800-52 TLS guidelines
- HIPAA § 164.312(e)
- Related controls: SC-7, SC-13, AC-17, AC-4
Related Guidelines
Related controls that commonly accompany SC-8.
Need Help Implementing SC-8?
Our auditors map NIST SP 800-53 controls to your HIPAA Security Rule program — policies, technical evidence, and audit readiness.