A public-health clinic issues laptops that may hold PHI. Which encryption approach best protects that data if a laptop is stolen while powered off?
Select an answer to reveal the explanation.
Short Explanation
TLS and VPNs are great for data in motion, but a stolen laptop sitting in a parking lot is data at rest. Full-disk encryption is like locking the whole filing cabinet—not just sealing the envelopes you mail—so a powered-off drive does not spill PHI.
Full Explanation
When a clinic laptop holding protected health information is stolen while powered off, the exposure is data at rest on local storage. Full-disk encryption binds readability of that volume to unlock material such as a passphrase, TPM-backed key, or recovery key. Without that material, the physical drive yields ciphertext rather than open charts, demographics, or cached documents, protecting confidentiality even if an adversary removes the disk and mounts it elsewhere.
TLS alone protects browser sessions in transit to clinic portals; it does nothing for files already written to the stolen laptop's disk after the session ends. Hashing filenames only obscures names in a one-way digest and does not encrypt file contents, so patient records remain readable if the filesystem is accessible. A VPN encrypts traffic on untrusted networks for data in motion; if staff are not connected, or if data already resides on disk, VPN provides no at-rest protection for a powered-off stolen endpoint.
Exam caveat: distinguish confidentiality controls for data in transit (TLS/VPN) from data at rest (full-disk or file encryption); hashing is integrity, not reversible secrecy. Operational check: enforce FDE on all PHI-capable municipal clinic endpoints, escrow recovery keys securely, verify encryption status in inventory before issue, and treat lost powered-off devices as cryptographic containment success only when unlock material never left with the hardware.