Answer
Encryption is an addressable implementation specification under the Security Rule. An organization must assess whether and how to implement it, document the decision, and consider reasonable alternatives where appropriate.
References
- Technical safeguards HHS Office for Civil Rights