Why this matters
HIPAA transmission security requires protecting ePHI in transit.
Applications serving ePHI must require HTTPS, disable insecure ciphers, and enable HSTS with preload and includeSubDomains. Reject cleartext HTTP requests.
HIPAA transmission security requires protecting ePHI in transit.
Side-by-side examples engineers can pattern-match during review.
app.UseRouting(); // accepts HTTP without HSTSapp.UseHsts(); app.UseHttpsRedirection();
app.Use(async (ctx,next)=>{ if(!ctx.Request.IsHttps) return; await next(); });// no HTTPS enforcement
app.UseRouting();app.UseHsts(); app.UseHttpsRedirection();From the same buckets as this rule.
Before persisting ePHI, encrypt using a data key protected by a Key Management Service (KMS). Use authenticated encryption (AES-256-GCM or equivalent), rotate keys, and store the key id and algorithm with the record.