Disclaimer; I haven't done HIPAA work for over a decade, and reality may vary from history. I welcome comments and alternative answers from someone currently working in the space.
The encryption specifications of HIPAA are "addressable", which is to say, they're not "required". You can choose to do something else as long as you document in writing that you believe your alternative is a "reasonable and appropriate security measure":
In meeting standards that contain addressable implementation
specifications, a covered entity will do one of the following for each
(a) implement the addressable implementation specifications;
(b) implement one or more alternative security measures to accomplish the same purpose;
(c) not implement either an addressable implementation specification or an alternative.
The covered entity’s choice must be documented. The covered entity
must decide whether a given addressable implementation specification
is a reasonable and appropriate security measure to apply within its
particular security framework.
So, you can choose to implement encryption, or to lock the drives in a drawer, or to do nothing at all - as long as you document that your decision that it is a "reasonable and appropriate security measure."
Now, in reality, you'll want to implement solutions that your auditors agree are reasonable and appropriate, or it goes on the report as a gap. Your management will want there not to be gaps on any audits, or their susceptibility to fines goes up. And when something bad happens, those documents that accept the risk of doing it otherwise become even more important.
So the best answer I can give you is to get a reputable auditor to review and approve any alternatives you consider. HIPAA is known for being hard to implement for this reason.