The most basic security truth in 2014 is that encryption done properly — a high enough level of encryption, proper safeguarding of the encryption key — is the best thing an IT department can do.
[See also: Where will HIT security be in 3 years?.]
Sill, many industries resist encryption — and healthcare is arguably the most strident.
