Further encryption needed to be HIPAA compliant