Under PHIPA there is no specific requirement to encrypt PHI. However, entities subject to PHIPA are required to take steps to safeguard PHI and it is the responsibility of each customer to determine whether encryption is appropriate to satisfy its security obligations.