I agree, the exact definition is that a HB is encrypted if it is sent after the CHANGE_CIPHER_SPEC message. I think this information is already stored in flags