Encryption use measures how consistently required encryption is applied to sensitive data and systems. Define what counts before reporting a percentage: a healthcare measure may count patient records fully encrypted across systems, while a full-disk encryption measure may count compliant systems. Check storage, transmission, and backups where they are in scope. section 4.1.1 section 4.2.2 section 7.3.6
The percentage matters because an unencrypted record or system can expose sensitive information, not merely lower a score. For a healthcare provider, encryption compliance supports HIPAA goals, patient trust, and protection against breach-related costs. Report the gap alongside the business risk and the action needed to close it. section 4.1.1 section 4.2.5
Turning a gap into a plan
A healthcare security report puts encryption compliance at 85% and targets full coverage by the end of the next quarter. Its immediate recommendation is to prioritize the remaining unencrypted data. In a separate systems dashboard, 20% of systems remain unencrypted against a 100% full-disk encryption target. A phased plan starts with systems holding sensitive data or facing greater exposure, then expands toward full coverage. section 4.2.5 section 7.3.6
Figure 7.6 The left side shows the Secure Tech data security dashboard before implementing data protection practices. The right side shows the situation after implementing these practices.
The before-and-after data security dashboard puts the encryption gap beside other protection and recovery targets, helping distinguish progress from the work still required. section 7.3.6
