Protecting Information During Transmission

HHS Enterprise system employees are required to use a secure link (e.g., encrypted) to transmit sensitive or confidential information. Such encryption should be accomplished only with systems approved by the IT department.

Password-protected documents are not considered a secure method for transmitting sensitive data, such as protected health information (PHI), electronic protected health information (EPHI), or personally identifiable information (PII). Although a password-protected document adds an additional level of security, the password may be broken using tools available on the Internet. Therefore, sending communications containing sensitive data and PHI must be encrypted.