Encrypting PHI: What HIPAA Requires and What Actually Protects Your Practice

Addressable does not mean optional

HIPAA lists encryption as an addressable implementation, which trips people up. Addressable does not mean optional. It means you must implement it, or document why an equivalent measure is in place, or why it is not reasonable and appropriate. For almost every modern practice, encryption is both reasonable and appropriate, and the alternative to implementing it is a breach that could have been avoided entirely.

Cover two layers at minimum

Cover two layers at minimum. Encrypt data at rest on servers, workstations, and any mobile device that could leave the building, and encrypt data in transit with TLS 1.2 or higher for email, VPN, and any web application handling PHI. Full-disk encryption on laptops is one of the highest-return controls you can deploy, because a lost encrypted laptop is generally not a reportable breach under the breach notification rules.

Document the evidence

Document the encryption you use, the standards you follow, and where it is enabled. Auditors want to see the evidence, not just hear that it is done. When encryption is in place and documented, you convert a potential breach into a non-event, which is the best outcome compliance can buy. This is core to our HIPAA IT compliance assessments.

What to do next

Run an encryption inventory across laptops, servers, email, and backups. Anything not encrypted is a priority this quarter.

• Addressable does not mean optional under HIPAA
• Encrypt laptops and mobile devices first for the highest payoff
• Document the standards and where encryption is enabled