HIPAA Encryption Requirements: Addressable Today, Proposed Required in the NPRM

What Applies Today

• Implement encryption if reasonable and appropriate for the environment.
• If not implementing, document why and implement an equivalent alternative measure if reasonable and appropriate (164.306(d)).
• Strong encryption also interacts with breach-risk analysis (encrypted PHI may reduce breach risk when keys remain uncompromised — document the assessment).

Practical Baseline

1. Encrypt ePHI at rest on servers, databases, endpoints, and backups where feasible.
2. Encrypt ePHI in transit (TLS for applications/APIs; VPN or equivalent for admin paths).
3. Manage keys separately from data; restrict and log key-admin access.
4. Record Addressable decisions in your Security Rule documentation set (6-year retention under 164.316(b)(2)).

How CyberSilo Helps

• CSA tracks encryption status per ePHI asset and stores decision memos
• ThreatHawk monitors anomalous access that could indicate key or data misuse

Frequently Asked Questions

Is encryption mandatory under HIPAA?

Under the current Security Rule, relevant encryption specifications are Addressable, not universally Required. The 2025 NPRM proposed making encryption required — not final as of 2026.

What if we cannot encrypt a legacy system?

Document why encryption is not reasonable and appropriate and implement equivalent alternative measures where reasonable and appropriate (164.306(d)).

Does encryption eliminate breach notification?

Strong encryption can reduce risk in a breach analysis, but you must still assess and document; do not assume a blanket exemption without analysis.

Related HIPAA Resources

HIPAA hub · §164.312 · MFA · CSA