AT-TLS for all ePHI in transit - MQ channel encryption for inter-system ePHI transfers - VPN or dedicated circuits for ePHI transmission to external partners