Properly Encrypting ePHI: What Your Practice Should Know

August 20, 2020

Even before COVID-19, electronic solutions were transforming the way practices work and communicate with patients and other providers. As technology continues to evolve within the healthcare industry, it’s important to understand how to properly secure sensitive protected health information (PHI) when stored or transmitted.

What does encryption actually mean?

Protecting patient data from cyberthreats goes beyond having appropriate passwords. It means having the right technical safeguards in place including properly encrypting any PHI created, stored, sent, or received by your practice. So what exactly is encryption? 

Encryption means that content containing sensitive data is made unreadable for anyone except those authorized to view the information. This process essentially uses a software or algorithm to ‘lock’ the data or written text and requires an encryption key to make the information decipherable again. 

What should be encrypted?

So what should be encrypted? Simply put, the answer to this question is pretty much anything containing PHI. This includes data that is being sent to someone else such as a patient, business associate, or another provider. Examples of this include: 

  • Laptop and desktop computers as well as external hard drives
  • Electronic Health Record (EHR) systems
  • Emails, text messages, and patient portal communications 

Why does encryption matter?

For a typical practice, your EHR system is likely already encrypted – but your EHR isn’t all that matters. All other laptops, external hard drives, servers, and communication systems are at high risk if they are not also properly encrypted to protect from cyberthreats.

In fact, failing to encrypt devices has been the cause of various HIPAA violations. Recently, a covered entity in Rhode Island faced a $1,040,000 fine from the OCR on top of a 2 year corrective action plan. The violation resulted from a stolen unencrypted laptop, leading to over 20,000 patients data being exposed. Part of the reason for the hefty fine was the organization’s “systemic non-compliance” when it came to proper encryption of devices. The entire incident could have been avoided if the entity had the proper technical safeguards in place. 

With cybersecurity threats on the rise and electronic communication becoming more commonplace, it’s all the more important to ensure the protection of your patients’ information. Implementing encryption services is a great way to best protect your practice and prevent HIPAA violations. If using an external vendor for encryption, make sure to have the appropriate business associate agreement in place as well.

RECENT POSTS

Related posts

HIPAA Compliant Remote Work
Abyde News, Best Practices, HIPAA

Secure Care, Anywhere: A HIPAA Guide to Telehealth and Remote Work

December 8, 2025 No comments yet

December 8, 2025   Nearly six years ago, office staff discovered that work from home was a possible model in the healthcare field. Not only did the work move to the house, but digital, at-home healthcare became wildly popular.  If part of your team is still working remotely, whether full-time or part-time, remember: HIPAA isn’t only within the four walls of your organization.  Here’s the good news: staying HIPAA compliant from a home office isn’t meant to be complicated. With the right tools and game plan, you can keep Protected Health Information (PHI) secure from the comfort of your own home.    Lock It Down at Home Remote work doesn’t change the HIPAA baseline. The standard of “minimum necessary” still applies, safeguards still span people, process, and technology, and documentation still matters. Think of compliance like a thermostat you’ve set correctly: once it’s dialed in, it quietly keeps everything in range. First, your staff needs to understand the standard requirements for keeping data secure and be trained on safely accessing PHI remotely. Do your employees know that it’s a big HIPAA no-no to share sensitive patient data with family during casual conversations while working from home? The best way to communicate what to do is through relevant, documented policies, including a remote work policy. It’s essential that work laptops and any devices with access to PHI are encrypted, and that all logins utilize Multi-Factor Authentication (MFA). Encryption and MFA are both additional layers of protection, ensuring that only authorized users can access PHI. Does staff utilize personal devices for work from home? If so, require mobile device management policies, encryption information, and clear off-boarding procedures. Have a lost-device and incident response policy so your team knows exactly who to notify, how to lock or wipe a lost device, and how you’ll assess whether an event rises to the level of a breach. The work station should also include HIPAA-compliant communication through email and phone calls. If you meet with patients through telehealth services, use an encrypted platform and verify the patient’s identity before each session.  As your organization ensures that the proper safeguards are in place, Business Associate Agreements (BAAs) must also be signed for any third parties (encryption services, IT providers, HIPAA-compliant platforms) with access to your PHI. BAAs offset the liability if a breach occurs due to your BA’s negligence. The legal document details exactly what each party is responsible for and how to handle any situation.  While the legal aspects might feel overwhelming, they are necessary to keep patient data safe. With clear policies, trained people, and the right security controls, remote work and telehealth can be both convenient and compliant.   Remote Ready  Remote work and telehealth are no longer temporary fixes to the problem of a pandemic; they’re a simple fact of operating today. HIPAA didn’t change with the scenery, but the right tools can. Intelligent software solutions can provide clear policies, thorough training, compliant BAAs, and more. Telehealth and remote work are here to stay. Keep the safeguards in place, and you’ll be compliant wherever you work, even at home. Meet with a compliance expert to learn more about how your remote organization can achieve HIPAA compliance. 

Email Safety in Healthcare
Abyde News, Best Practices, HIPAA

One Click Away from a Breach: Protecting your Practice from Phishing Emails

August 28, 2025 No comments yet

August 28, 2025   We’ve all received an email that’s a little too good to be true.  Maybe it’s a “Congratulations, you’ve won a free vacation!” message, or a heartfelt request from an “international prince” who just needs your bank details. While these examples may sound obvious, phishing emails today are far more convincing, using logos, sender names, and even tone that mirror trusted organizations. However, healthcare staff have an even bigger target on their backs due to the sensitive nature of Protected Health Information (PHI). Healthcare staff, from the office manager to the doctor, are close to patients’ Social Security Numbers, billing information, and more, all of which are a goldmine for a malicious actor.  In light of the most recent $170,000 phishing HIPAA fine, it’s essential to review the best tips for keeping your email and patient data secure.    Email Safety 101 When hackers send 3.4 billion phishing emails daily, it’s essential to remain vigilant when reviewing emails. One mistaken click can jeopardize thousands of health records, so always carefully read your emails.  While your spam filter might hide some risky emails, phishing has become more advanced, including spoofing staff members and, in general, looking legitimate upon first glance.  First, when receiving an email, always think before you click. Does the email look suspicious? Is the grammar odd? Are there unnecessary attachments? Never download any attachments unless you are sure of the sender. A hacker could expose your entire practice to ransomware with one unsafe attachment. All it takes is one click.  When receiving an email, always ensure the account looks authentic. A familiar name doesn’t always mean a safe email. Cybercriminals are betting on healthcare staff not knowing the difference between ‘yourboss@email.com’ and ‘y0urboss@email.com’. The internet also provides hackers access to public posts, so even if the profile photo might be of your boss, chances are it isn’t your boss sending you an email demanding personal information.  Watch for common red flags.  If an email feels unusual, pause before acting, especially with messages marked as “urgent.” Cybercriminals rely on panic to push quick clicks. For example, an email shouting “WARNING: Update your EHR immediately using this link” is likely a scam designed to trick you into handing over access.  Delete spam emails or forward them to your phishing IT team (if applicable, likely for larger organizations), and ensure your team is aware of any threats and trained to identify and handle them appropriately.    Keeping it Secure Phishing emails aren’t rare; they’re routine.  That’s why it’s critical to give your staff the tools they need to safeguard PHI. A strong compliance program goes beyond policies by providing hands-on email safety training, encouraging protections like multi-factor authentication, and connecting your practice with trusted IT resources. Meet with an expert today to learn more about HIPAA compliance and email safety.  

HIPAA Security Rule Updates
HIPAA, Legislation

The HIPAA Security Rule is Changing: Is Your Practice Ready?

January 23, 2025 No comments yet

January 23, 2025 The HIPAA Security Rule went into effect in 2003, and it’s an understatement to say that technology has changed quite a bit since then. The Office for Civil Rights has released proposed updates for the HIPAA Security Rule. After a historic year of breaches, this legislation comprehensively strengthens the current Rule. This is the first update of the legislation in a decade. Many of the new requirements simply reinforce existing recommendations within the Security Rule, which now makes best practices mandatory. This legislation is the result of the significant rise in cyber attacks and the OCR’s continuous noncompliant findings when investigating Covered Entities and Business Associates. Although the proposed rule has not yet been finalized, legislation will likely be enacted within the next year, given bipartisan support for protecting patient data. What is the HIPAA Security Rule? The Security Rule, a critical component of HIPAA, centers on stringent guidelines for managing electronic Protected Health Information (ePHI). These guidelines encompass a wide range of safeguards—including physical, administrative, and technical—all designed to ensure the protection of sensitive patient data. One of the most significant components of the Security Rule is completing a Security Risk Analysis (SRA). The SRA sets a benchmark for your practice and assesses what your practice currently does to protect patient data. This analysis includes safeguards ranging from physical measures, like door alarms, to technical precautions, like properly encrypting files. This analysis is a yearly procedure for the OCR and continues to be emphasized in this proposal. In this new proposal, the OCR strictly defines the SRA as a yearly requirement with more guidelines on specific questions. The OCR has introduced eight implementation specifications for risk analysis. This also includes a thorough analysis of potential natural disasters and the consequences if a Business Associate was breached. In fact, the government has introduced a Risk Analysis Initiative, fining practices and businesses that do not complete this analysis. While this assessment is a major component of this rule, once vulnerabilities are identified, it’s up to your practice to implement these safeguards to protect your patients. What’s Changing? This proposed rule mandates that Covered Entities and their Business Associates implement certain proactive measures that were previously only strongly recommended, such as multi-factor authentication. As technology has greatly advanced since the introduction of this rule, there are also more requirements focused on system management, including required anti-malware protection, disabling unused network ports, and a network map, highlighting what devices are connected to specific networks in an organization. Network segmentation is another advancement of the rule, requiring practices to use different networks based on access to specific information. New policies and procedures will also be required if this proposal goes into effect. For instance, contingency plans will be required, showing what a practice or business plans to do if it is breached within 72 hours. Additionally, practices need to have a transition plan when staff leaves, and they need to notify other regulated entities when a staff member’s access to ePHI is changed or terminated. Business Associates (BAs) will also face stricter requirements when working with Covered Entities. If breached, BAs must notify their Covered Entities within 24 hours. BAs will also now have to have their compliance program certified by a Subject Matter Expert in cybersecurity on a yearly basis, ensuring that the business is taking the right steps to protect patient data. What Can I Do? While this rule is still within its comment period until early March, it could be enacted this year. Being aware of upcoming HIPAA legislation and preparing your practice is vital. Working with a smart compliance solution can take the pressure off, with compliance experts updating their systems to ensure their users will be compliant with new laws. Looking to understand HIPAA compliance for your practice before new laws take effect? Schedule a consultation with one of our experts today.