HIPAA Encryption Requirements

“Addressable” Does Not Mean Optional

The single biggest misconception in HIPAA compliance is that “addressable” means optional. Under 45 CFR 164.306(d)(3), covered entities must follow a specific decision process for every addressable specification:

Encrypting Data at Rest

Data at rest is any ePHI stored on a physical medium — hard drives, SSDs, USB sticks, backup tapes, or cloud storage volumes. The standard referenced by HIPAA is NIST SP 800-111 (Guide to Storage Encryption Technologies). In practice, this means AES-256 encryption with XTS mode for full-disk encryption.

Lost or stolen devices account for a significant share of HIPAA breaches. If a laptop with properly documented encryption is stolen, it qualifies for the breach safe harbor under 45 CFR 164.402(2). No breach notification is required if the data was encrypted and the key was not compromised.

Encrypting Data in Transit

Data in transit is ePHI moving across a network — between a browser and server, between email systems, or between your EHR and a clearinghouse. The governing NIST standard is NIST SP 800-52 (Guidelines for TLS Implementations). The minimum acceptable protocol is TLS 1.2, with TLS 1.3 strongly recommended.

For detailed guidance on specific platforms, see our guides on whether Gmail is HIPAA compliant, Zoom meets HIPAA standards, or our comparison of HIPAA-compliant email providers.

HIPAA Password Requirements

HIPAA itself does not prescribe specific password complexity rules. Instead, the Security Rule at 45 CFR 164.312(d) requires “procedures for verifying that a person or entity seeking access to ePHI is the one claimed.” The de facto standard for meeting this is NIST SP 800-63B (Digital Identity Guidelines), which HHS explicitly references in enforcement guidance.

The single most impactful change: stop forcing 90-day password rotations. NIST research shows that mandatory rotation leads to weaker passwords (users choose predictable patterns like Spring2026! → Summer2026!). Instead, pair strong initial passwords with ongoing security awareness training and credential monitoring.

MFA: Current Status & 2026 Rule Update

Today, MFA is not explicitly named in the HIPAA Security Rule. It falls under the “access control” standard at 45 CFR 164.312(a)(1). However, virtually every OCR resolution agreement since 2020 has included MFA as a corrective action item. The message is clear: single-factor authentication is no longer acceptable.

The three authentication factor categories

For small practices, the most cost-effective MFA approach is combining passwords with a free authenticator app (Google Authenticator, Microsoft Authenticator, or Duo). Hardware keys (YubiKey, Titan) add stronger phishing resistance for admin accounts. Ensure your business associate agreements require MFA from all vendors accessing your ePHI.

HIPAA Firewall Requirements

The Security Rule does not use the word “firewall” explicitly, but 45 CFR 164.312(e)(1) requires “technical security measures to guard against unauthorized access to ePHI transmitted over an electronic communications network.” Firewalls are the primary mechanism for meeting this requirement. OCR expects a defense-in-depth approach with multiple layers.

Document your entire network architecture as part of your risk assessment. The proposed 2026 rule would require network segmentation maps and annual penetration testing for all covered entities.

The Encryption Safe Harbor

Perhaps the single strongest business case for encryption: the HITECH Act breach safe harbor at 45 CFR 164.402(2). If ePHI is encrypted in accordance with HHS guidance and the encryption key was not compromised, the data is considered “unsecured PHI” exception — meaning no breach notification is required.

To qualify for the safe harbor, your encryption must meet the standards specified in HHS Guidance (Federal Register Vol. 74, No. 79): NIST SP 800-111 for data at rest and NIST SP 800-52 for data in transit. Self-built or unvalidated encryption schemes do not qualify. Organizations with the 2021 HITECH amendment (HR 7898) protections can further reduce penalties by demonstrating recognized security practices, including NIST-compliant encryption, for at least 12 months prior to an incident.

Implementation Guide for Small Practices

You do not need a six-figure security budget. Most small practices can achieve full encryption compliance using built-in tools and free software. Follow these steps in order — each builds on the previous.

Once you’ve completed these steps, validate your posture with a HIPAA compliance checklist and schedule a full risk assessment if you haven’t completed one in the last 12 months.