Transmission security, built on a flow inventory

Most clinics can describe how they protect devices. Almost none can list where PHI actually goes when it leaves one.

The policy is composed from your clinic’s facts

Your transmission security policy is generated against your recorded facts. It covers protecting PHI in transit, both addressable safeguards with your recorded decisions rendered in, a defined secure channel for sending to parents, schools, and other providers, and minimum-necessary discipline about what gets sent at all. Conditional clauses handle the parent portal as the secure route, fax handling, and telehealth session-link practice.

The flow inventory is the part most tools skip

This control has its own module, where you map the paths PHI actually takes: what leaves your clinic, where it goes, and how. That inventory is the thing almost no clinic has, and it is what makes the rest of this control answerable rather than theoretical.

Eight requirements are tracked:

• The policy is active and reviewed within the last twelve months.
• At least one PHI transmission flow has been inventoried.
• Every inventoried flow is recorded as encrypted in transit.
• The platform’s own encryption in transit is attested.
• Both addressable decisions are finalized and recorded.
• The policy is adopted, and its facts have not drifted.

Worth knowing: with no flows inventoried, this control reports a gap rather than staying silent. An empty inventory is a real finding here, not an absence of data.

What this is, and what it is not

Encryption in transit is a value you record per flow. The system does not probe endpoints, inspect TLS, or measure traffic. Your inventory is as complete as what you put in it, and each flow’s encryption status is as accurate as your knowledge of that system.

What the system provides is the structure: a place for the inventory to live, a policy that references it, and a status that goes red when flows are missing or unencrypted rather than letting the question stay unasked.

What an investigator gets

A dated, adopted policy. An inventory of your PHI transmission flows with encryption status per flow. A record of your addressable decisions. The answer to “where does PHI go when it leaves here,” which is a question most clinics cannot answer at all.