HIPAA requires encryption in transit and lists encryption at rest as addressable.  What does all that mean?