By Eric Andrew Kristof, RN, CAHIMS | Healthcare IT Professional | HIMSS Arkansas Chapter Member
About This Series: The HIMSS Word of the Day is a running blog series drawing from the HIMSS Dictionary of Health Information and Technology Terms, Acronyms, and Organizations, 6th Edition (2025) — the authoritative reference for healthcare IT professionals and the primary study resource for CAHIMS and CPHIMS certification. Each post paraphrases the term in plain language, grounds it in real-world healthcare IT context, and adds a bedside nursing perspective you won’t find in a textbook.
📖 The Term: Encryption
Source: HIMSS Dictionary of Health Information and Technology Terms, Acronyms, and Organizations, 6th Edition (2025)
🔍 Plain-Language Definition
Encryption is the process of transforming readable information, called plaintext, into an unreadable form, called ciphertext, using a mathematical algorithm and a key. Only someone with the correct key can decrypt the ciphertext back into readable data.
The HIMSS Dictionary offers two descriptions. It calls encryption a technology that converts data into a secret code, notes that reading an encrypted file requires a secret key or password, and distinguishes plain text from cipher text. It also describes encryption as a way of securing data by converting it into apparently random characters between source and destination, using a complex function and a special key so the meaning is not obvious.
| Encryption Concept | What It Means | Healthcare Example |
|---|---|---|
| Symmetric Encryption | The same key encrypts and decrypts | AES encrypting a database or laptop drive |
| Public Key (Asymmetric) Encryption | A public key encrypts or verifies; a private key decrypts or signs | Certificates used in TLS and Direct messaging |
| Data at Rest | Stored data | Encrypted servers, laptops, backups, and mobile devices |
| Data in Transit | Data moving across networks | TLS for web portals and APIs; VPN tunnels |
| Key Management | Creating, storing, rotating, and revoking keys | A hardware security module protecting database keys |
| Hashing | A one-way function, not reversible encryption | Verifying file integrity or storing password hashes |
⚠️ Exam Alert: Encryption is reversible with the right key; hashing is one-way. Symmetric encryption uses one shared key; asymmetric uses a key pair. Encryption protects confidentiality, but it does not stop an authorized user from misusing data. Under HIPAA‘s current Security Rule, encryption is an addressable specification.
🌐 Why It Matters: Real-World Healthcare IT Context
Encryption is one of the most effective safeguards for health information. Lost or stolen laptops, phones, and backup drives have been a common source of healthcare breaches, and encryption can render the data on them unreadable. Data moving across networks, from patient portals to APIs to interfaces, also needs protection from interception.
HIPAA treats encryption as an addressable implementation specification for both data at rest and data in transit under the current Security Rule. Organizations must assess whether encryption is reasonable and appropriate and implement it, or document why not and use an equivalent alternative. In practice, encryption is widely expected, and HHS’s proposed Security Rule update would make it generally required with limited exceptions.
Encryption also affects breach notification. HHS guidance explains that PHI encrypted consistent with NIST guidance, with keys kept separate and uncompromised, is not considered unsecured. If such data is lost or stolen, breach notification obligations may not apply. That makes encryption both a security safeguard and a significant risk reduction strategy.
Standards define strong encryption. NIST’s Advanced Encryption Standard, FIPS 197, is widely used for data at rest, and NIST guidance such as SP 800-111 addresses storage encryption for end-user devices. The Cryptographic Module Validation Program tests products against FIPS 140-3, and many organizations require validated modules. TLS protects most data in transit.
Key management is often the hardest part. Encryption is only as strong as the protection of its keys. Keys stored alongside the data they protect, shared broadly, or never rotated undermine encryption. Organizations need processes for generating, storing, backing up, rotating, and revoking keys, and must ensure they can recover encrypted data during disasters.
Encryption has limits. It protects data from people who lack the key, but authorized users, compromised accounts, and malware running on a logged-in device can still access decrypted data. Ransomware attackers also use encryption against organizations, encrypting systems to demand payment. Encryption is one layer in a broader defense.
The future brings new challenges. Large-scale quantum computers could eventually break widely used public key algorithms. NIST has published post-quantum cryptography standards, including FIPS 203, and organizations with long-lived health data are beginning to inventory their cryptography and plan transitions.
Common encryption gaps in healthcare:
- Unencrypted laptops, USB drives, or backup media
- Legacy systems or devices that cannot encrypt data
- Internal network traffic left unencrypted
- Keys stored with the data they protect
- Outdated algorithms or protocol versions
- Encrypted data that cannot be recovered after key loss
Practices for strong encryption:
- Full-disk encryption on laptops and mobile devices
- Encryption for databases, backups, and cloud storage
- TLS for all external and sensitive internal connections
- Validated cryptographic modules and current algorithms
- Documented key management and recovery procedures
- Planning for post-quantum cryptography migration
🏥 The Nurse’s Perspective: Clinical, Bedside, & Workflow
Encryption works mostly behind the scenes, but nursing practices help keep it effective.
At the Bedside
Organization-issued laptops, tablets, and phones are typically encrypted and managed. Using these devices, rather than personal ones, for patient information ensures that data stays protected if a device is lost or stolen.
Lost or stolen devices should be reported immediately, even if encrypted. Prompt reporting allows security teams to confirm encryption status, disable accounts, and wipe devices remotely.
In Clinical Workflow
Sending patient information by regular email or text may not be encrypted end to end. Using approved secure messaging, secure email options, or the patient portal keeps PHI protected in transit.
USB drives and other removable media are a common source of breaches. Many organizations block or encrypt them automatically, and nurses should avoid copying patient information to portable media unless an approved, encrypted method is used.
Patients sometimes ask whether portal messages and video visits are secure. Nurses can explain that organizational tools use encryption and encourage patients to avoid sharing sensitive information through unsecured channels.
In EHR Implementation (Go-Live Perspective)
During an Epic Go-Live, technical teams configure encryption for databases, backups, interfaces, mobile devices, and remote access, and verify that downtime reports and business continuity workstations store data securely.
At-the-elbow support analysts may help nurses enroll mobile devices, set up secure messaging, or understand why certain actions, like saving files locally, are blocked. Explaining the reasons behind these controls improves acceptance.
🎓 CAHIMS / CPHIMS & HIMSS Perspective
CAHIMS Exam Domain Mapping
Encryption appears in security, privacy, and infrastructure questions:
| CAHIMS Domain | How Encryption Appears |
|---|---|
| Healthcare & Technology Environments | HIPAA addressable specifications; breach notification guidance; proposed rule changes |
| Clinical Informatics | Secure messaging, mobile devices, patient communication |
| Healthcare Information & Systems Management | Algorithms, key management, data at rest and in transit, TLS, validated modules |
| Management & Leadership | Risk management, policy, vendor requirements, breach cost avoidance |
Key Terms to Know Alongside Encryption
- Plaintext and Ciphertext — readable data and its encrypted form
- AES — the Advanced Encryption Standard, a widely used symmetric algorithm
- Public Key Infrastructure (PKI) — the system of certificates and keys supporting asymmetric encryption
- Key Management — processes for generating, protecting, rotating, and revoking keys
- Hashing — a one-way transformation used for integrity checks and password storage
- Post-Quantum Cryptography — algorithms designed to resist attacks by quantum computers
HIMSS Organizational Position
HIMSS encourages encryption of health data at rest and in transit as part of layered cybersecurity through its Healthcare Cybersecurity Community, research, and policy engagement. Members can find related education and research through the HIMSS Resource Center.
🔗 Explore Further: External References
- HHS — Guidance to Render Unsecured PHI Unusable, Unreadable, or Indecipherable https://www.hhs.gov/hipaa/for-professionals/breach-notification/guidance/index.html
- NIST — SP 800-111, Guide to Storage Encryption Technologies for End User Devices https://csrc.nist.gov/pubs/sp/800/111/final
- NIST — FIPS 197, Advanced Encryption Standard (AES) https://csrc.nist.gov/pubs/fips/197/final
- NIST — Cryptographic Module Validation Program https://csrc.nist.gov/projects/cryptographic-module-validation-program
- NIST — FIPS 203, Module-Lattice-Based Key-Encapsulation Mechanism Standard https://csrc.nist.gov/pubs/fips/203/final
- HIMSS — Healthcare Cybersecurity Community https://www.himss.org/networking/communities/healthcare-cybersecurity/
Term source: HIMSS Dictionary of Health Information and Technology Terms, Acronyms, and Organizations, 6th Edition (2025). All definitions in this series are paraphrased for editorial purposes. Readers are encouraged to consult the primary source for exact language.
Eric Andrew Kristof, RN, CAHIMS is a Healthcare IT professional and HIMSS Arkansas Chapter member based in Hot Springs Village, AR, with hands-on Epic Go-Live experience and a diverse healthcare and IT background. He writes at kristof.org at the intersection of clinical care and healthcare technology.
Leave a Reply