What constitutes as a comparable alternative to encryption? I know that password keepers and other services are not comparable and are not considered encryption.

If the context is authorized access only, does unmounting offline drives in a locked up location classify as a comparable alternative for example.

This is in context with HIPAA/URAC. Data storage, user information, and sensitive type information. Nothing in terms of networks or traffic communications.

  • 5
    It would help to have more context, both in terms of the environment (Is the title a quote? From what? Are we talking PCI, HIPAA, ISO 27001?) and target (stored data? network traffic? user credentials?) – gowenfawr Aug 25 '15 at 16:57
  • 3
    This is probably something you should discuss with your HIPAA auditor. – Stephen Touset Aug 25 '15 at 17:48
  • For URAC, use their own Inquiry form in order to get interpretations: urac.org/accreditation/InterpretationsForm.aspx – schroeder Aug 25 '15 at 18:52

Disclaimer; I haven't done HIPAA work for over a decade, and reality may vary from history. I welcome comments and alternative answers from someone currently working in the space.

The encryption specifications of HIPAA are "addressable", which is to say, they're not "required". You can choose to do something else as long as you document in writing that you believe your alternative is a "reasonable and appropriate security measure":

In meeting standards that contain addressable implementation specifications, a covered entity will do one of the following for each addressable specification:

(a) implement the addressable implementation specifications;

(b) implement one or more alternative security measures to accomplish the same purpose;

(c) not implement either an addressable implementation specification or an alternative.

The covered entity’s choice must be documented. The covered entity must decide whether a given addressable implementation specification is a reasonable and appropriate security measure to apply within its particular security framework.

So, you can choose to implement encryption, or to lock the drives in a drawer, or to do nothing at all - as long as you document that your decision that it is a "reasonable and appropriate security measure."

Now, in reality, you'll want to implement solutions that your auditors agree are reasonable and appropriate, or it goes on the report as a gap. Your management will want there not to be gaps on any audits, or their susceptibility to fines goes up. And when something bad happens, those documents that accept the risk of doing it otherwise become even more important.

So the best answer I can give you is to get a reputable auditor to review and approve any alternatives you consider. HIPAA is known for being hard to implement for this reason.

Not the answer you're looking for? Browse other questions tagged or ask your own question.