Partner still on FTP
Claims files with ePHI move via clear FTP. SC-9 project migrates to SFTP with key auth and retires FTP.
Transmission Confidentiality
High Risk
Moderate
Medium Cost
SC-9 requires protecting the confidentiality of transmitted information. Cleartext HL7 on VLANs, unencrypted partner FTP, and legacy radio/Wi-Fi without modern crypto still appear in healthcare and undermine HIPAA transmission security expectations.
Control Objective
Protect confidentiality of ePHI in transit using encryption and architectural protections appropriate to the path — including internal high-risk segments and external partner links.
Implementation Guidance
- Inventory transmissions that include ePHI (APIs, HL7/FHIR, VPN, email gateways, file transfers).
- Mandate TLS 1.2+ or equivalent for external and high-risk internal paths.
- Disable cleartext protocols for ePHI file exchange (replace FTP with SFTP/HTTPS).
- Use VPN/private connectivity plus encryption for partner links when needed.
- Manage certificates (SC-17) to avoid insecure fallbacks.
- Monitor for cleartext ePHI protocol use.
- Document risk acceptance only with compensating controls for rare legacy exceptions.
- Align with 164.312(e) addressable encryption decisions.
Real-World Use Cases
How this control shows up in healthcare and HIPAA-covered environments.
Internal HL7 in clear on shared VLAN
Segmentation plus TLS wrapping on the interface engine protects against casual sniffing.
Expired TLS causes fallback
Certificate process fixes prevent opportunistic cleartext during portal outages.
Best Practices
- Encrypt ePHI transmissions by default.
- Eliminate FTP/telnet for ePHI.
- Certificate life-cycle hygiene.
- Monitor for cleartext.
- Time-boxed legacy exceptions.
- Cover partners and internal high-risk paths.
Common Gaps & Violations
- Cleartext HL7 considered fine on the internal network.
- FTP exceptions without expiry.
- Broken TLS ignored.
- Emailing ePHI without encryption gateway.
- No inventory of ePHI transmissions.
Required Documentation
- Transmission confidentiality standard (SC-9)
- Inventory of ePHI transmission paths
- Encryption configuration baselines
- Exception register
- Monitoring/alert evidence for cleartext
How to Test & Validate
- Sample partner and internal interfaces for encryption.
- Scan for cleartext ePHI protocols.
- Review exception ages.
- Check certificate monitoring.
- Verify email/file gateway encryption for ePHI.
Audit Considerations
Transmission encryption is among the most tested HIPAA technical areas. SC-9 evidence should show encryption in practice across interfaces — not only VPN for remote users.
HIPAA Mapping
How this NIST control supports HIPAA Security Rule expectations.
- 164.312(e)(1) Transmission Security — guard against unauthorized access to ePHI transmitted over networks.
- 164.312(e)(2)(ii) Encryption — addressable encryption of ePHI in transit.
- 164.306 CIA — confidentiality of ePHI during transmission.
- 164.308(a)(1) Risk Analysis — cleartext transmission risk must be analyzed and treated.
Compliance Tips
- Build an interface encryption scorecard for leadership.
- Refuse new cleartext partner connections.
- Pair SC-9 with SC-8 transmission integrity where both apply.
Frequently Asked Questions
Is SC-9 the same as SC-8?
SC-8 focuses transmission integrity; SC-9 focuses confidentiality — implement both for ePHI paths.
Is network segmentation enough without encryption?
Sometimes cited as compensation; prefer encryption for ePHI and document any exception rigorously.
Do we encrypt workstation-to-EHR on campus?
Prefer TLS for application sessions; risk-base additional network crypto for sensitive segments.
References & Resources
- NIST SP 800-53 Rev. 5 — SC-9
- Related controls: SC-8, SC-13, SC-17, AC-17, CA-3
Related Guidelines
Related controls that commonly accompany SC-9.
Need Help Implementing SC-9?
Our auditors map NIST SP 800-53 controls to your HIPAA Security Rule program — policies, technical evidence, and audit readiness.