As HIPAA's language is somewhat vague when it comes to actual technical requirements, what are best practices for PHI encryption for HIPAA compliance?
I've seen varying levels at different organizations. Some just encrypt it in transfer, some when at rest as well. One organization I dealt with required PGP encryption of files even when transferring over SFTP.