<i>Is it reasonable and appropriate not to encrypt traffic between an app and a database inside a virtual private cloud? ... There is little official guidance for engineers and developers today</i><p>While HHS may not tell you what to do on your own private cloud, if you host on a public cloud, you'll have to sign a BAA where the provider will tell you what you need to do to ensure HIPAA compliance of their platform. AWS, for example, requires encryption everywhere -- end-to-end encryption from the client to your servers, encrypting all PHI data sent between your servers (web, app, db servers, etc), and encrypting all data at rest.<p><a href="https://aws.amazon.com/compliance/shared-responsibility-model/" rel="nofollow">https://aws.amazon.com/compliance/shared-responsibility-mode...</a><p>If public cloud providers require encryption everywhere, I'd sure hate to have to explain in a HIPAA audit why I thought it was not "reasonable and appropriate" to do the same thing in my own datacenter after investigation for a breach that used a network sniffer between my servers.<p>We had one application that did not support encryption natively, everything was sent in the clear, so we ended up setting up a point-to-point VPN between those servers to encrypt data in transit. Otherwise, AWS wouldn't have signed off on the BAA if we could not assure them that all PHI was encrypted.