No encryption — neither dataset encryption nor DB2 column encryption for ePHI - No AT-TLS — EDI transmissions (837/835 claims files) from providers used FTP over unencrypted TCP - DB2 authorization was table-level, not column-level — anyone with SELECT on the CLAIMS table could see all columns, incl