HIPAA Encryption for Therapy Practices: A Working Checklist

You do not need to turn HIPAA encryption into a technology procurement project. Start by listing where electronic protected health information (ePHI) sits, how it moves, which safeguards are active, and what evidence supports your decision. Use this educational workflow as a practical starting point, not as legal advice. For a broader one-person operating system, use the solo-practice HIPAA checklist. For an incident after a device or message problem, use the HIPAA breach-notification response path.

Educational resource for licensed US mental-health clinicians and practice staff. HIPAA, vendor terms, and applicable breach rules can change. Verify current primary sources before relying on a workflow.

What HIPAA says about encryption

Protect ePHI in two places: while it is stored and while it travels between approved systems. Check both paths instead of assuming that one safeguard covers the other. Treat each HIPAA encryption decision as a documented control with a named owner and review date.

The Security Rule names encryption and decryption for ePHI at rest as an “addressable” implementation specification in 45 CFR 164.312(a)(2)(iv). It names encryption for ePHI in transit as an addressable implementation specification in 45 CFR 164.312(e)(2)(ii).

Addressable does not mean “optional, so skip it.” Under the Security Rule’s addressable framework, assess whether the specification is a reasonable and appropriate safeguard in your environment. If it is, implement it. If it is not, document why and implement an equivalent alternative measure if that alternative is reasonable and appropriate. Keep the analysis with your risk analysis and security policies. Ask healthcare counsel or a qualified security advisor about a high-risk exception; do not use a short checklist as a legal conclusion.

The practical question is not only, “Does this app say encrypted?” Ask, “What ePHI does it handle, where is it stored, how does it move, who controls the keys, and what evidence can I retrieve?”

Data at rest and data in transit

Use two passes through your practice. Encryption at rest protects stored data. Encryption in transit protects data as it moves between systems or across a network. A control in one category does not automatically prove the other.

Devices

Where data sits

Laptop, desktop, phone, and tablet

What to encrypt

Full-device or volume storage that contains ePHI

How to check it

Confirm the operating-system setting, recovery process, and device inventory

Why it matters

A stolen device can expose local notes, downloads, caches, or attachments

EHR and cloud storage

Where data sits

EHR and cloud storage

What to encrypt

Stored records, exports, and provider-managed backups

How to check it

Read the provider’s current security documentation and contract terms; save the review date

Why it matters

A web login does not by itself explain storage encryption or backup scope

Removable drives and local backups

Where data sits

Removable drives and local backups

What to encrypt

Every copy of ePHI on portable media

How to check it

Record encryption status, custody, storage location, and restore test

Why it matters

Portable media is easy to lose and easy to forget in an inventory

Email and file transfer

Where data sits

Email and file transfer

What to encrypt

The message and attachment path used for clinical content

How to check it

Confirm the secure-message workflow, recipient controls, and vendor terms

Why it matters

A secure device does not make an ordinary personal inbox a clinical channel

Stored data deserves an inventory

List the places a note, intake form, recording, or export can persist:

• Practice laptops, phones, tablets, and desktop computers
• EHR databases, document areas, exports, and audit-log stores
• Cloud drives, synchronization folders, and trash or version-history areas
• Local and cloud backups, including snapshots and disaster-recovery copies
• Removable drives, printed-to-PDF folders, and temporary downloads
• Telehealth recordings or transcripts, if the approved workflow permits them

For each system, record the owner, data type, encryption control, key-management responsibility, retention rule, BAA status, and evidence location. If you cannot tell whether a system retains a copy, treat that as an inventory gap and ask the provider.

Moving data deserves a separate check

Map the route from client to clinician and back. That can include a patient portal, telehealth session, EHR API, email gateway, mobile notification, calendar integration, printer, or vendor support channel. Confirm how the path is protected and whether the workflow sends more detail than the clinical task requires.

TLS on a connection does not answer every question about what the receiving system stores. Likewise, an encrypted laptop does not protect an attachment after it leaves that laptop. Check storage and transfer controls separately, then write the boundary in your policy.

What addressable means in a therapy practice

Use a short decision record rather than a one-word status. A defensible record connects the safeguard to your risk, the alternative you selected, and the evidence you reviewed.

1. Define the scope. Name the ePHI, systems, devices, users, vendors, and transfer routes.
2. Assess the risk. Consider unauthorized access, loss, theft, remote work, household access, malware, vendor failure, and backup exposure.
3. Choose the safeguard. Implement encryption and decryption when reasonable and appropriate for the risk and environment.
4. Document an alternative when needed. If the named specification cannot be implemented as written, explain why and record the equivalent measure, owner, deadline, and residual risk.
5. Test and revisit. Keep evidence that the control is active and repeat the review after a new vendor, device, workflow, incident, or material configuration change.

The written conclusion should describe your practice, not copy a vendor’s marketing sentence. “Encrypted” is a starting point. It is not a complete risk analysis.

What to ask a vendor before PHI moves

A signed BAA is important when the vendor is a business associate. The BAA rule requires contractual assurances about permitted handling and appropriate safeguards, but it is not a security certificate. Ask the vendor to identify the control and the boundary it covers. See 45 CFR 164.504 for the BAA requirements.

• Is ePHI encrypted at rest? Which databases, object stores, backups, logs, caches, and search indexes are included?
• Is ePHI encrypted in transit? Which interfaces, mobile clients, integrations, support channels, and exports are included?
• Who manages encryption keys? Can the vendor describe key rotation, access restrictions, and separation of duties?
• What happens when a user exports, downloads, prints, records, or deletes data?
• Which subprocessors handle ePHI, and how will the vendor notify you of a material change?
• What audit logs, security reports, and incident notices can you receive?
• What are the retention and destruction rules when the account closes?
• Does the service use client content to train a public model, and where is that setting documented?

Save the vendor answer, the BAA, the date reviewed, the person who reviewed it, and any open question. If a vendor will not answer a material question, do not treat silence as a safeguard.

The breach safe harbor

The Breach Notification Rule defines unsecured protected health information as PHI that has not been rendered unusable, unreadable, or indecipherable to unauthorized people through a technology or methodology specified by the Secretary. That definition is the starting point for a federal breach-notification analysis; a vendor’s use of the word “encrypted” is not, by itself, a completed incident assessment.

Encryption may affect whether a lost or stolen device contains “unsecured” PHI for federal breach-notification analysis. It does not mean you ignore an incident. Preserve facts, contain access, identify the data, apply the required risk assessment, and consult counsel and your carrier when the decision is material or unclear.

Do not promise clients that encryption makes a practice breach-proof. Do not write that a lost device is automatically outside notification duties. Record the facts and the analysis that supports the decision.

A repeatable encryption review

Make this HIPAA encryption review part of the same operating rhythm as your device inventory and vendor review. Revisit the HIPAA encryption decision whenever a system, vendor, or transfer route changes.

As a practical cadence, revisit this review when you add a system, change a vendor, move to a new device, change remote-work arrangements, or investigate an incident. Pair it with your broader risk analysis and periodic evaluation under 45 CFR 164.308.

1. Map the data

Write down every system, device, backup, export, message path, and removable medium that creates, receives, maintains, or transmits ePHI. Include temporary files and vendor support channels.

2. Separate storage from transfer

For each item, record the at-rest control and the in-transit control separately. Mark what you verified, what the vendor controls, and what remains unknown.

3. Check the human path

Confirm unique accounts, MFA, automatic locking, screen privacy, secure disposal, approved messaging, and a rule against downloading clinical content to unmanaged personal storage.

4. Save evidence

Keep configuration evidence, vendor responses, BAA dates, policy versions, backup restore results, and the name of the reviewer. Make the evidence retrievable without relying on one person’s memory.

5. Assign gaps

Every gap needs an owner, a target date, a temporary control, and a residual-risk note. Escalate a material gap instead of hiding it under the word “addressable.”

Which HIPAA guide do you need

When you review ePHI, separate the protections for stored data from the protections for transferred data. The solo-practice HIPAA guide covers the full one-person operating system: roles, minimum necessary access, policies, vendors, and annual review. The HIPAA breach-notification guide covers the response path after a suspected disclosure. Start with the compliance resource hub when you need the wider practice map.

Carry the review into your practice

Use the solo-practice HIPAA checklist to carry the encryption review into your device inventory, vendor review, annual risk analysis, and incident plan. It is an educational worksheet, not a certification or legal opinion.

References

• Electronic Code of Federal Regulations. (2025). 45 CFR 164.306: Security standards: General rules.
• Electronic Code of Federal Regulations. (2025). 45 CFR 164.308: Administrative safeguards.
• Electronic Code of Federal Regulations. (2025). 45 CFR 164.312: Technical safeguards.
• Electronic Code of Federal Regulations. (2025). 45 CFR 164.504: Business associate contracts or other arrangements.
• Electronic Code of Federal Regulations. (2025). 45 CFR 164.402: Definitions.