While encryption is currently an "addressable" specification under HIPAA, it provides the strongest protection for ePHI and creates safe harbor from breach notification requirements.
Benefits of Encryption
2025 Update: Mandatory Encryption
The proposed 2025 HIPAA Security Rule updates would make encryption REQUIRED (not addressable) for all ePHI at rest and in transit. Organizations should implement encryption now to prepare for this change and benefit from immediate security improvements.
HIPAA addresses two types of encryption: protecting stored data and protecting data being transmitted.
Encryption of ePHI stored on any media, whether physical or cloud-based.
Encryption of ePHI while being transmitted over networks or the internet.
Follow these steps to implement comprehensive encryption across your organization.
Identify every location where ePHI is stored and every method of transmission.
Choose encryption solutions that meet HIPAA guidance and industry standards.
Deploy encryption across all identified ePHI storage and transmission points.
Establish robust key management practices to protect encryption keys.
Verify that encryption is working properly across all systems.
Continuously monitor and update encryption implementations.
Because encryption is currently "addressable," you can choose not to implement it IF you document why it's not reasonable and appropriate and implement equivalent alternatives. However, this is increasingly difficult to justify.
If your risk assessment determines that your internal network is sufficiently secure (e.g., air-gapped, physically secured, no external access), you may determine that encryption in transit is not necessary for internal communications. However, this is becoming increasingly difficult to justify given modern network complexity and the 2025 HIPAA updates proposing mandatory encryption.
If you have legacy systems that cannot support encryption, you must document why encryption is not reasonable and appropriate, and implement equivalent alternative measures such as physical security, network segmentation, or limited access. Plan to replace or upgrade these systems as soon as feasible.
Performance impact is generally not an acceptable reason to skip encryption with modern hardware and encryption algorithms. If performance is a concern, you can use hardware-accelerated encryption, optimize encryption implementations, or upgrade infrastructure. Document performance testing and mitigation measures.
Important Note
With modern encryption technologies being widely available, cost-effective, and having minimal performance impact, it is very difficult to justify not implementing encryption. HHS expects encryption for ePHI in nearly all circumstances. The proposed 2025 updates would eliminate the addressable status entirely, making encryption mandatory.
45 CFR 164.312(a)(2)(iv)
Encryption and Decryption for Data at Rest (Addressable)
45 CFR 164.312(e)(2)(ii)
Encryption for Data in Transit (Addressable)
45 CFR 164.402
Breach definition (encryption safe harbor)
NIST SP 800-111
Guide to Storage Encryption Technologies