[flipper35]

I know encryption is an "addressable" issue and not required when it comes to HIPAA compliance, but can someone justify to me why we should continue this partnership?

Here is the situation. We have a partnership with someone who provides certain PHI and the product is written in Java. That Java application then phones home through their website via HTTP port 80. Disregarding the Java crap part for now, how can they provide documentation that addresses the security concerns of transmitting all this in the clear?

Aside from the info being encrypted inside the app before transmitting either direction I cant see how this is compliant.

Thanks.