Encryption Is Turned On. Can You Prove It?

“Are your devices encrypted?”

“Yes.”

“Can you show me?”

That second question is where most practices go quiet. Not because encryption isn’t on somewhere, but because nobody can produce a list that says which devices, as of when, and where the keys are.

A control you can’t demonstrate is a control that doesn’t count when it matters. Here are five things owner-doctors should know about the difference between turned on and managed.

Turning it on was step one

Enabling encryption on a device is a checkbox. It takes a minute and it works.

The problem is what happens after. Devices get replaced. Staff bring in a new laptop. A tablet gets wiped and reset. Someone disables it to troubleshoot and forgets to turn it back on. A new hire’s machine ships from the vendor without it.

Six months later, the practice still believes every device is encrypted, and the true number is somewhere around two-thirds. Nobody lied. The setting just drifted, one device at a time, with no one watching.

What managed encryption means

Managed encryption is the difference between hoping and knowing. It means:

A central policy that requires encryption on every device the practice controls, enforced automatically rather than device by device
Recovery keys escrowed in a system the practice owns, not in an employee’s personal account or on a sticky note
Continuous reporting that shows every device, its encryption status, and when it last checked in
Alerts when a device falls out of compliance, so it gets fixed before it gets lost
A defined offboarding step that recovers or wipes the device when someone leaves

None of that is exotic. It’s the difference between a setting and a system.

The three moments you’ll be asked for proof

You won’t be asked on a normal day. You’ll be asked at one of three moments, and each one is stressful enough without a scramble.

The insurance renewal, when the questionnaire asks whether all devices holding sensitive data are encrypted and the carrier expects that answer to be verifiable.

The audit or risk assessment, when someone wants to see the inventory and the status of each item on it.

The incident, when a device is lost or stolen and whether you have to notify patients depends on whether you can show, with a dated record, that the device was encrypted at the time.

A practice with managed encryption answers all three with a report. A practice without it answers with a conversation.

What a report should look like

If your IT provider or your own system can’t produce something like this on request, that’s worth a conversation:

Every practice device by name, type, and assigned user
Encryption status for each, with the date it was last confirmed
Where the recovery key is held, and that it’s not on the device itself
Any device out of compliance and what’s being done about it
The date the report was generated

That one document answers the insurer, the auditor, and the investigator. It also answers you, because it tells you whether the thing you believe is true.

Encryption you can’t prove is a checkbox, not a control

Insurers, regulators, and investigators have stopped accepting “yes” as an answer. They want to see the list.

That’s not bureaucracy for its own sake. It reflects how incidents actually go: the one unencrypted device is the one that gets lost, and the practice only learns it wasn’t covered when the notification clock is already running.

Managed encryption closes that gap. It’s one of the highest-return controls a practice can put in place, because it turns the most common bad day into a non-event and proves it.

We help practices move from “I think it’s on” to a managed, reported, key-escrowed encryption program that holds up under every one of those three moments. It starts with a 10-minute discovery call.

Call us at 405-253-5101 or schedule a discovery call to get started.