Universal encryption of PHI at rest is going to be INCREDIBLY painful. Hospitals mostly have onprem, locked down mainframe IRIS systems that host data. If the IRIS data is encrypted at rest then it can’t be compressed which means hospitals will have to buy a bunch more hardware which is super expensive, especially these days.

This doesn’t get you much in terms of security. The IRIS system itself is an OLTP so it’s going to need to constantly pass around the encryption key and use it constantly, and if an attacker gets disk access they also will have access to the keys.

So this is a big waste of everyone’s time and money.