Encryption - Medera

Layer	Algorithm	Key management
PHI columns at rest	AES-256	Per-tenant Data Encryption Key (DEK), wrapped by Key Encryption Key (KEK) in managed KMS
Backups at rest	AES-256	Customer-managed KEK option (BYOK)
Object storage at rest	AES-256	Customer-managed key option
In transit	TLS 1.3	HTTPS enforced
WebSocket	TLS 1.3	WSS enforced	PHI fields (SSN, insurance policy number, address, phone, email) are encrypted at the column level. Phone and email are also hashed for search.

Encrypted fields (Patient model)

patients ├─ ssn ENCRYPTED (AES-256) ├─ insurance_policy_number ENCRYPTED ├─ address ENCRYPTED ├─ phone ENCRYPTED + HASHED for search └─ email ENCRYPTED + HASHED for search

Key rotation

DEK rotation: quarterly, transparent re-encryption
KEK rotation: annual
Customer-managed keys (CMK) option for the KEK layer (enterprise plans) See Key Management for the rotation procedure. ---