Is encryption actually required under HIPAA?

Practitioners must understand that "addressable" does not mean optional. Instead, it requires a robust risk analysis to determine if encryption is a reasonable and appropriate safeguard for the specific ePHI environment. If the risk analysis concludes that encryption is not appropriate, the entity must document the rationale thoroughly and implement an equivalent alternative measure, or document why no alternative is reasonable or appropriate. Given the current threat landscape and the sensitivity of ePHI, it is exceptionally challenging to justify not encrypting ePHI, particularly when at rest or in transit over public networks. Failure to implement encryption without a strong, documented justification and an effective alternative significantly increases an organisation's risk exposure and potential liability in the event of a breach.

A common pitfall is misinterpreting "addressable" as a loophole to avoid encryption. This misunderstanding often leads to non-compliance findings during audits by the Office for Civil Rights (OCR). Simply stating that encryption is not feasible without a detailed, evidence-based risk assessment and a documented alternative is insufficient. Furthermore, the quality and strength of the encryption implemented are critical. Organisations must ensure that the chosen encryption methods are robust enough to protect against reasonably anticipated threats and align with industry best practices, rather than relying on outdated or weak cryptographic controls. The OCR consistently views unencrypted ePHI as a significant vulnerability, underscoring the practical necessity of its implementation.