We do use both the cell-level encryption and the SHA256 when data is sent to the vendors (EM, MPUSH, DM, etc.).The requirement was for the system users not to have the ability to view PII columns however some of the PII data is needed for the vendors.