Requirements
What the regulation expects
Customer-controlled keys under HIPAA
Technical safeguards should show who can reach ePHI; keys you govern make that auditable.
Access control and workforce clearance
Keys should align with role-based access: only approved systems and operators can trigger decrypt operations, with traceability.
Integrity and non-repudiation of protections
You must guard against improper alteration or destruction. Cryptographic integrity plus controlled keys supports defensible controls for systems-of-record.
Vendor and BAA boundaries
A BAA does not remove the need for strong technical separation. External keys limit vendor access even when they operate the application stack.
Solutions
Relevant DuoKey products
Standardise how EHR-adjacent apps, data lakes, and integration layers consume keys under your security programme.
Learn moreBind storage encryption to keys outside AWS’s default custody model.
Learn moreKeep Microsoft from being the sole administrator of keys that protect regulated content.
Learn moreReplace direct identifiers with tokens under your key control.
Learn moreKey themes
Where customer-controlled keys fit
DuoKey provides the technical key separation that auditors look for when assessing ePHI safeguards — ensuring that encryption is not just enabled but controlled by the covered entity or its designated business associate.
§164.312(a)(2)(iv) — encryption and decryption
Implement mechanisms consistent with your risk analysis; external key management documents who can decrypt and how.
§164.312(b) — audit controls
Integrate KMS and HSM audit streams with your SIEM for ePHI access paths that involve cryptography.
Related links
Useful resources