How do you handle PHI encryption?

PHI encryption uses two layers. At rest: AES 256 encryption on the database level via cloud provider (RDS encryption, Azure encrypted volumes) plus application level field encryption for specifically sensitive columns using Laravel's encrypted cast or custom encryption casts with rotating keys. In transit: TLS 1.3 for all external traffic, mutual TLS for service to service communication, encrypted message bus for internal queues. Key management uses AWS KMS, Azure Key Vault, or HashiCorp Vault depending on the deployment infrastructure. Encryption keys never sit in application configuration files or shared documents.