HIPAA lists encryption as addressable in two places: encryption and decryption of ePHI under access control, and encryption of transmitted ePHI under transmission security. Addressable means you must assess it and either implement it or document a reasoned alternative. For modern systems, encryption is usually the easy answer and the hard one to argue against.
The two places encryption appears
Under 164.312(a), the access control standard includes an addressable specification to use a mechanism to encrypt and decrypt ePHI. This is the at rest case: databases, file stores, laptops, backups.
Under 164.312(e), transmission security includes an addressable specification to encrypt ePHI whenever deemed appropriate. This is the in transit case: browsers, APIs, email, file transfer, internal service traffic.
What the assessment should cover
Write the decision per data store and per network path, not once for the company.
- Where does ePHI live? List databases, object storage, endpoints, removable media, backups and logs.
- Where does it travel? List user traffic, partner links, internal calls, and exports.
- What can the system do? Some legacy devices cannot encrypt. Note that honestly.
- What is the risk if it were exposed? Think theft of a laptop, a misconfigured bucket, a network tap.
- What is the decision, and who approved it?
Alternatives that hold up
If a legacy system cannot encrypt traffic, an alternative might be a network segment with strict access, plus a tunnel that encrypts the link between that segment and the rest of the network. Compare this to DICOM, which supports TLS but does not require its use; the DICOM site notes that some facilities run unencrypted DICOM inside VPNs, and calls that potentially unwise from a cybersecurity standpoint. Document why your alternative gives comparable protection, and plan to retire it.
Encryption does not fix everything
Encrypting a disk does not help if every employee can read every record through the application. Key management matters too: who can use the keys, how are they rotated, and where do they live. Encryption at rest also protects against lost hardware far more than against a compromised account.
Keep the decision record current
Review it when you add a data store, change a vendor, or move to a new cloud service. See why addressable is not optional for the decision record format.
Safeguard's asset discovery can help you find systems and data stores to include in the inventory, though the legal assessment remains yours.
Quick check
Is encryption required by the HIPAA Security Rule?
It is addressable. You must assess it and either implement it or document why not and what you do instead.
Do I need a separate decision for in transit and at rest?
Yes, they sit in different standards, access control and transmission security, so record each one.
Sources
- 45 CFR 164.312, Technical safeguards (eCFR)
- 45 CFR 164.306, Security standards: General rules (eCFR)
- DICOM security (dicomstandard.org)
Last reviewed: 19 October 2026.
