No, HIPAA does not yet require encryption everywhere — that's still just a proposal
You may have heard that HIPAA now requires encrypting all patient data. It doesn't — not yet. Federal regulators proposed making encryption mandatory (it's currently just "recommended"), but that proposal has not been finalized into law as of this writing. There's no deadline to comply with yet. Once it is finalized, organizations would get 60 days before it takes effect and 240 days after that to actually comply — so there will be advance warning. Worth watching, not worth panicking about yet.
Sources differ:
- This bulletin describes the proposed compliance clock as 60 days to take effect plus a further 240 days to comply; several compliance-industry summaries of the same NPRM describe it as 60 days to take effect plus 180 more days to comply (240 days total from publication). The cited Federal Register excerpt provided does not include the specific compliance-timeline section, so this could not be chec