Although encryption is not mandatory, it can be a HIPAA violation if records are unencrypted and no other measure that is equally as effective has been implemented. Encryption is an addressable implementation specification of the Security Rule. This means organizations can only avoid implementing the requirement if it is not reasonable and appropriate in the circumstances, or if an alternative security measure is equally as effective. If organizations fail to encrypt records, they have to document the reasons why.