Encryption Isn't Optional: Why 'Addressable' Doesn't Mean 'Ignorable'
The HIPAA Security Rule lists encryption as an "addressable" specification, and that single word has caused more compliance gaps than almost any other part of the regulation. Practices read "addressable" and assume it means optional, so encryption gets skipped entirely.
That's not what the word means. "Addressable" means a practice must assess whether encryption is reasonable and appropriate for its environment, and if it decides not to implement it, document an equivalent alternative safeguard and the reasoning behind that decision. For most small practices, encryption is both reasonable and appropriate, and skipping it without documentation leaves the practice exposed on two fronts.
Where Practices Typically Skip It
Full-disk encryption on laptops and workstations is often missing, especially on older machines. Email is even more commonly overlooked, with PHI sent as plain text attachments or in message bodies with no encrypted gateway in place. Backup drives and USB devices frequently store PHI with no encryption at all.
The Real Cost of Getting This Wrong
If an unencrypted laptop or drive containing PHI is lost or stolen, that is presumed to be a reportable breach under HIPAA, triggering notification obligations to patients and potentially the Department of Health and Human Services. If the same device had been properly encrypted, the loss may not qualify as a breach at all, because the data would be unreadable to whoever found it.
That distinction alone, encrypted versus unencrypted, is often the difference between a quiet non-event and a costly, public breach notification process.
What Proper Encryption Looks Like
A defensible setup includes full-disk encryption on every device that stores PHI, encrypted email for anything containing patient information, and encryption for data both at rest and in transit. Just as important, the decision to implement (or not implement) each control needs to be documented, showing that the practice actually evaluated the risk rather than simply ignoring the requirement.
How Consolidated IT Solutions Can Help
Consolidated IT Solutions helps small practices move encryption from an assumed gap to a documented, defensible safeguard, including:
- Full-disk encryption rollout across laptops, desktops, and portable storage
- Encrypted email gateways for messages containing PHI
- Encryption of data at rest and in transit across your systems
- Written documentation of the risk-based decisions behind each safeguard
- A prioritized plan for closing any remaining encryption gaps