Glossary
Encryption at rest
Also called: Data-at-rest encryption, full-disk encryption
In one sentence
Scrambling stored data — on laptops, servers, phones or in the cloud — so it’s unreadable to anyone without the key.
Encryption at rest protects data while it’s sitting on a disk. If someone steals a laptop, pulls a drive out of a server or gets hold of a backup file, all they see is scrambled data. On Windows PCs this is usually BitLocker; on Macs it’s FileVault; Microsoft 365 encrypts mailbox and file data in its data centers.
For healthcare, encryption has a special role. Under the HIPAA Security Rule, encryption of electronic PHI is an “addressable” specification — you must implement it or document why an equivalent alternative is reasonable. More importantly, HHS breach-notification guidance treats PHI that is properly encrypted (to NIST standards, with the key not compromised) as “secured.” If an encrypted laptop is stolen, that generally isn’t a reportable breach. An unencrypted one usually is.
Encryption only works if it’s actually on, on every device, and the recovery keys are stored safely somewhere other than the device. Device management tools like Intune can switch encryption on automatically, escrow the keys to your Microsoft account and report any device that isn’t compliant.
Example: a hygienist’s laptop is stolen from a car. Because Intune enforced BitLocker and the device needed a sign-in to unlock, the practice confirms the drive was encrypted, wipes the device remotely, and documents the incident — rather than notifying patients. Encryption at rest pairs with encryption in transit. See our HIPAA Security Rule checklist.
Related terms
- Encryption in transitProtecting data while it travels between devices or across the internet, so it can’t be read or altered on the way.
- BitLockerMicrosoft’s full-disk encryption built into business editions of Windows, which makes a lost or stolen PC’s data unreadable.
- ePHI (electronic protected health information)ePHI is protected health information that is created, stored, received or sent in electronic form — the data the HIPAA Security Rule exists to protect.
- TPM (Trusted Platform Module)A security chip (or chip-level feature) in a computer that stores encryption keys and checks the computer hasn’t been tampered with.
- Microsoft IntuneMicrosoft Intune is Microsoft's cloud service for managing and securing company computers, phones and tablets — settings, apps, updates and encryption — from one place.
- HIPAA Security RuleThe HIPAA Security Rule is the federal regulation that sets the administrative, physical and technical safeguards healthcare providers and their vendors must use to protect electronic patient information.