Existing Wording: o When transmitting PHI (Personally Identifiable Healthcare Information) or other confidential information over an unsecured channel, systems SHALL use TLS or other equivalent secure transport protocols (determined to be sufficient through risk analysis) to provide a secure channel

Proposed Wording: o When transmitting PHI (Personally Identifiable Healthcare Information) or other confidential information over an unsecured channel, systems SHOULD use TLS or other equivalent secure transport protocols (determined to be sufficient through risk analysis) to provide a secure channel

Comment:

In the case this occurs in a controlled network this might not be needed. Although I recognize the need, mandating this in all situations goes to far. Suggest replace it with SHOULD

Summary:

Make TLS a SHOULD, not SHALL