Many U.S. hospitals are in the same position: critical diagnostic, imaging, and clinical systems run on older platforms with long lifecycles (often 10–20 years). Because many of these are regulated medical devices, changing their software can trigger FDA re-certification, which is costly and slow.

Instead of wholesale replacement, you can focus on data-centric protection around those systems:

• Protect data in motion from each device – A solution like Certes DPRM (Data Protection and Risk Mitigation) encrypts data as it leaves the device over IP networks, so the payload is only accessible to the data owner, no matter where it travels.
• Apply policies at the data-flow level – Each application data flow (for example, imaging data to PACS, lab results to EHR) can have its own protection policy, encryption key, and key rotation schedule. This makes each flow effectively invisible to others on the network.
• Use crypto-segmentation instead of network redesign – DPRM enables segmentation and isolation at the data level, without complex and expensive network architecture changes or replacing medical equipment.
• Extend protection to medical IoT – The same approach can secure IP-connected IoT devices in your environment (CCTV cameras, security devices, etc.), keeping their data/control streams separate from other traffic.

This approach helps you:

• Extend the useful life of legacy systems while improving security.
• Reduce the risk and cost of breaches—the average cost of a healthcare data breach now exceeds $10 million (IBM, 2024).
• Move toward HIPAA-aligned safeguards without a disruptive rip-and-replace program.

Certes DPRM is designed to help you rethink data protection at the flow level, but it does not replace your overall HIPAA compliance program. Here’s how it maps to key requirements:

Where DPRM helps

• Data-centric protection for PHI – DPRM uses encryption and crypto-segmentation so that only authorized data flows can access protected payloads. This supports the HIPAA Security Rule’s technical safeguards for access control, integrity, and transmission security.
• Flow-level policy enforcement – Centralized policy and key management let you enforce who/what can access specific data flows, and for how long (via key rotation). This supports risk management and information access management.
• Audit and monitoring support – Centralized reporting on protected flows provides security telemetry that can feed your monitoring and incident detection processes.
• Backup and DR integration – Encryption and key management can be integrated into backup and disaster recovery architectures to help protect ePHI in those workflows.
• Vendor and BAA safeguards – Separation of duties and customer-owned keys reduce vendor exposure and can support safeguards expected in Business Associate Agreements.

What still remains your responsibility

• HIPAA Privacy Rule processes – DPRM does not manage legal bases for processing, consent, authorizations, minimum necessary determinations, or Notice of Privacy Practices. You still need policies, workflows, and documentation for these.
• Individual rights handling – Requests for access, amendments, restrictions, confidential communications, and disclosure accounting remain operational and legal processes you must manage.
• Risk analysis and governance – You must conduct and document an enterprise risk analysis, maintain a risk register, appoint a Privacy Officer, and train your workforce.
• Identity and access management – User IDs, roles, MFA, joiner/mover/leaver processes, and application-level controls are handled by your IAM, EHR, and endpoint tools, not by DPRM.
• Physical and endpoint security – Facility access controls, workstation security, device/media controls, and sanitization procedures remain your responsibility.
• Incident response and reporting – IR playbooks, forensics, breach assessment, and regulatory notifications are outside DPRM and must be run by your security and compliance teams.

In short, DPRM provides technical controls that support HIPAA Privacy and Security Rules, especially around encryption, segmentation, and key management. You still need the surrounding policies, governance, and operational processes to achieve and demonstrate compliance.

The financial and operational impact of a healthcare data breach is significant—the average cost now exceeds $10 million (IBM, 2024), the highest of any industry. Certes DPRM can help you reshape how you manage breach risk, particularly around whether data is considered “unsecured” under HIPAA.

How DPRM influences breach notification

• Strong encryption and key control – When PHI is encrypted to recognized standards (for example, NIST-aligned) and the keys are not compromised, the data may be treated as “secured” rather than “unsecured” under HIPAA.
• Data rendered unintelligible – DPRM’s encryption and crypto-segmentation render exfiltrated data unintelligible to unauthorized parties. In many scenarios, this can reduce the likelihood that a breach triggers notification obligations, subject to your risk assessment.
• Separation of duties and customer-owned keys – Because you retain control of keys, even if a vendor environment is impacted, the attacker may not gain access to readable PHI. This can limit both exposure and downstream notification scope.

What does not change

• Notification duties still apply when PHI is unsecured – If unencrypted PHI is exposed, you must still notify affected individuals and HHS without unreasonable delay and no later than 60 days after discovery. For incidents affecting 500 or more individuals in a state or jurisdiction, media notification is also required.
• Business associate obligations remain – Business associates must still notify covered entities of breaches. DPRM can reduce the likelihood and impact of those breaches, but it does not replace contractual and regulatory duties.
• Risk assessment is still required – You must perform and document a breach risk assessment to determine whether notification is required in each case.

Practically, by encrypting PHI in motion and enforcing strong key management, Certes DPRM can:

• Lower the chance that an incident qualifies as a reportable breach of “unsecured” PHI.
• Reduce the volume of data exposed in an incident.
• Help contain costs associated with investigation, notification, and remediation.

It is a technical safeguard that supports your broader breach response strategy, but it does not remove the need for formal incident response and compliance processes.