It surprises people every time. The HIPAA Security Rule labels each safeguard either required or addressable, and encrypting patient information, at rest and in transit, is addressable. The rule has said so since 2003.
Addressable does not mean optional. It means a covered entity has to assess whether encryption is reasonable and appropriate for its situation, and then either do it or write down why not and what it did instead that gives equivalent protection. The writing-down part is what an auditor asks for, and "we never got around to it" is not an equivalent protection.
Here is why the question answers itself. Under the breach notification rules, patient information that was encrypted the way the Department of Health and Human Services describes, with the key kept separately, is not considered unsecured. A laptop lost in an airport, a phone left in a cab, a stolen backup drive: if the data on it was encrypted, there is no reportable breach, no letters to patients, no notice to the press, no entry on the public list. If it was not, there is all of that. One encrypted laptop pays for the whole program.
Where it matters most in a practice: every laptop and desktop (Windows and Mac both encrypt the disk for free, if someone turns it on and keeps the recovery keys somewhere safe); every phone that sees email; email itself, to patients, to other practices, to the lab and the billing company; the file shares; and the backups, which are a complete copy of everything and are often the thing nobody encrypted.
The rule is also moving. In early 2025 the Department proposed an update to the Security Rule that would make encryption required, with narrow exceptions. Whatever the final version says, encryption is already the standard of care, and the practices that treat it as one have nothing to change.
In every one of our plans the computers are encrypted and the keys are kept. Encrypted email is our own, built for this: the message is private, it works from Outlook, and the person receiving it needs nothing. Security + Compliance keeps the risk analysis and the written decisions an audit asks for. If you run a practice and are not sure which of these is true for you today, pick a time and we will tell you plainly.
Let's talk
Thirty minutes with a real person.
Tell us what's going on with your technology, what's working and what isn't. We'll listen, ask a few questions, and tell you honestly whether we're the right fit. No slides, no pitch. If we can help, we'll say how. If we can't, we'll point you to someone who can.
Reach out, any way you like. A real person takes it from there.
Based in downtown Winter Haven since 1996, with offices in Orlando, Tampa, St. Petersburg, and Miami, serving businesses across Florida.