HIPAA Requires Encryption?

[Matthew Link <link () UCMO EDU>]

Very recently, I inherited the job of focusing information security efforts.  In the process of upgrade of a SQL 
server, a question has arisen regarding the provision in HIPAA (Addressable) to encrypt EPHI at rest on both the server 
and the backup media.  It does come at some additional cost, though it's manageable.  Before proceeding, however, I 
thought I'd ask if anyone has suggestions. 

Thanks, 
--Matthew Link. 
  Director, User Services 
  Information Services, UCM 
  660-543-8063 
  link () ucmo edu