Perhaps he doesn't type while walking. Perhaps he has the treadmill stopped while he needs to type, but when it's time to read a PDF or be on a conference call, he fires it up and walks a little. "Checking e-mail and twitter" doesn't require much, if any, typing.
If you're going to claim to know the implementation of a standard, it's usually best to actually know the standard. HIPAA (one P, two As) specifically states:
Covered entities must consider the use of encryption for transmitting EPHI, particularly
over the Internet. As business practices and technology change, situations may arise
where EPHI being transmitted from a covered entity would be at significant risk of being
accessed by unauthorized entities. Where risk analysis shows such risk to be significant, a
covered entity must encrypt those transmissions under the addressable implementation
specification for encryption.
Slashdot Mirror
Perhaps he doesn't type while walking. Perhaps he has the treadmill stopped while he needs to type, but when it's time to read a PDF or be on a conference call, he fires it up and walks a little. "Checking e-mail and twitter" doesn't require much, if any, typing.
Covered entities must consider the use of encryption for transmitting EPHI, particularly over the Internet. As business practices and technology change, situations may arise where EPHI being transmitted from a covered entity would be at significant risk of being accessed by unauthorized entities. Where risk analysis shows such risk to be significant, a covered entity must encrypt those transmissions under the addressable implementation specification for encryption.