The Most Expensive Word in HIPAA
The Security Rule sorts its implementation specifications into two kinds: required and addressable. Encryption of electronic protected health information, both at rest and in transit, is addressable. So are automatic logoff, a unique user identification review process, and several other controls.
Somewhere in the twenty-plus years since, "addressable" got widely translated as "optional." It does not mean that, has never meant that, and the gap between what it means and what practices believed it meant shows up repeatedly in enforcement findings.
What It Actually Means
For an addressable specification, you have three lawful paths, and only three:
One: implement it as written. Encrypt the data. Done.
Two: implement an equivalent alternative measure that achieves the same protection, and document what you did and why it is equivalent.
Three: implement nothing — but only after assessing whether the specification is reasonable and appropriate for your environment, concluding in writing that it is not, and documenting that reasoning along with what you are doing instead to manage the risk.
Notice what all three have in common. Two of them require a written analysis, and the third requires you to actually do the thing. There is no fourth path where you simply do not address it. "Addressable" describes flexibility in how you meet the standard, not permission to skip it. What practices have historically done — nothing, with no documentation — is not one of the available options.
Why This Shows Up in Enforcement
When an investigator asks why ePHI on a stolen laptop was unencrypted, there are two possible conversations.
In the first, you produce a dated assessment explaining that you evaluated full-disk encryption, and you either implemented it or you concluded it was not reasonable and appropriate for a specific documented reason, with compensating controls named. That is a defensible position. Reasonable organizations reach different conclusions, and the rule was deliberately written to allow that.
In the second, there is no document. The honest answer is that nobody ever considered it. That is not a judgment call the regulator can evaluate — it is an absence, and absences are what get cited.
The rule's flexibility was designed for the enormous range of covered entities it governs, from solo practitioners to national systems. But flexibility is granted on the condition that you exercise judgment and record it. Skipping the record forfeits the flexibility.
Where Encryption Is Genuinely Worth It
Setting compliance aside, encryption has an unusual property: it can prevent a breach from being a breach at all. Under the Breach Notification Rule, PHI that has been rendered unusable, unreadable, or indecipherable to unauthorized persons — encryption meeting recognized standards being the primary method — falls into a safe harbor. A lost encrypted laptop is generally not a reportable breach. The same laptop unencrypted is letters to patients, a posting on the federal breach portal, and quite possibly an investigation.
That asymmetry is why encryption is the highest-leverage item on most practices' lists:
- Laptops and mobile devices. Full-disk encryption ships with current Windows and macOS. Minutes per machine.
- Backups. Especially anything leaving the building or sitting with a third party. An unencrypted backup is a complete copy of everything, in one portable object.
- Portable media. USB drives and external disks, if you permit them at all — and many practices should not.
- Email carrying PHI. Either encrypted transport with a partner you have verified, or a secure messaging channel. See 8 ways practices leak PHI over text and email.
- Databases and servers at rest. Increasingly a default in modern systems; the work is confirming it is on rather than assuming it.
The Direction of Travel
There is a reason this word matters more now than it did five years ago. The proposed Security Rule overhaul would remove the addressable category for several specifications, including encryption — making them flatly required. That rule is now expected no earlier than 2027, so the flexibility survives for the moment.
But the regulator's view of what is reasonable and appropriate has already moved. In 2026, concluding that encrypting a laptop is not reasonable for your practice is a difficult position to defend, because the control is built into the operating system, costs nothing, and is implemented by organizations of every size. The written analysis is still your path — it is simply much harder to write a credible one.
What to Do This Week
Make a list of every addressable specification you are not currently implementing. For each, decide: implement it, implement an alternative, or write the analysis explaining why not. Most practices find that implementing is faster than documenting a defensible refusal — which is, arguably, exactly what the rule's authors intended.
Then keep the analyses with your risk documentation. They are part of the same story: what you found, what you decided, and why.
Related Reading
- The Security Rule overhaul just slipped to 2027
- What the overhaul would actually require
- OCR now asks what you did about your risk analysis
- The HIPAA risk assessment, explained
Call to Action
If you have never written an addressable-specification analysis, you are not unusual — and it is a short document. Schedule a walkthrough to see how those decisions live alongside your risk analysis and policies, or take the 3-minute readiness quiz.