Why End-to-End Encryption Matters

The lockbox analogy

You need to send a confidential document to a colleague across town. Two options exist. First: hand the document to a courier and trust they will not read it along the way. Second: place the document in a locked box, keep the key, and give your colleague a copy of the key in advance. The courier still carries the box, but even if they look inside their bag, all they find is a locked box they cannot open.

End-to-end encryption works the same way for patient data. Information is scrambled before it ever leaves the device where it was created and stays scrambled until it reaches your authorized device, where it is unscrambled for reading. Everyone in between — the software company, the cloud provider, anyone who might intercept the data — sees only the locked box.

Server-side encryption vs. zero-knowledge encryption

Most software platforms advertise that they “encrypt your data.” That sounds reassuring, but what it actually means varies widely. Two distinct approaches exist, and the distinction has serious consequences for healthcare practices.

Server-side encryptionmeans the software company encrypts your data on their servers. Outside attackers are blocked, but the company holds the keys. They can decrypt and read your patient information at will — for support requests, internal analytics, legal demands, or if a disgruntled employee decides to look. This is equivalent to handing your document to a courier who puts it in their own lockbox yet keeps the key in their pocket.

Zero-knowledge encryption (also called client-side or end-to-end encryption) means data is encrypted on your device before it reaches the server. The company never possesses the key. They store the locked box but genuinely cannot open it. Even under a court order, they could only hand over encrypted gibberish — the key lives on your device.

Why this matters for HIPAA

HIPAA mandates safeguards to protect patient information — Protected Health Information, or PHI. Encryption ranks among the most important technical safeguards available.

A detail many providers miss: HIPAA's Breach Notification Rule contains a critical safe harbor for encryption. If compromised data was encrypted to NIST standards, the incident may not qualify as a reportable breach. That can mean the difference between a quiet internal review and public notification to every affected patient, the Department of Health and Human Services, and potentially the media.

The catch: that safe harbor applies only if the encryption keys were not compromised alongside the data. When the company holding your data also holds the encryption keys, and both are breached together, the safe harbor vanishes. Zero-knowledge encryption prevents exactly that scenario.

What happens in a breach: two scenarios

Two healthcare practices both experience a server breach.

Practice A uses a platform with server-side encryption. The attacker gains access and finds both encrypted data and encryption keys stored together. Patient names, contact information, insurance details, and intake form responses are decrypted. Practice A must notify every affected patient within 60 days, report to the HHS Office for Civil Rights, and if more than 500 patients are affected, alert local media. Potential fines range from $100 to $50,000 per violation, plus reputational damage and possible lawsuits.

Practice Buses a platform with zero-knowledge encryption. The same attacker accesses the server and finds encrypted data — but the encryption keys do not exist there. They reside only on the provider's personal devices. The attacker holds a mass of scrambled data they cannot read. Under HIPAA's encryption safe harbor, Practice B may not need to report the incident as a breach at all. No patient notifications, no media alerts, no fines.

Identical breach. Vastly different outcomes. The only variable is where the encryption keys reside.

Beyond compliance: patient trust

Compliance is the floor, not the ceiling. Patients increasingly recognize that their data is both valuable and vulnerable. Telling a patient that their intake information is encrypted before it leaves their browser — and that not even the software company can read it — offers something most practices cannot: genuine, verifiable privacy.

In healthcare, patients share deeply personal information — reasons for seeking care, medication history, family situations, financial details. The trust they place in you extends to every tool you use to collect and store that information.

How Soli handles encryption

Soli was architected around zero-knowledge encryption from the start. Every form submission is encrypted in the patient's browser before transmission. Text messages, voicemail recordings, voicemail transcripts, and AI call transcripts are encrypted so that only authorized devices can read them. Soli's servers store and transmit the data but never hold the decryption keys.

Every paid plan includes a Business Associate Agreement (BAA), placing the legal framework alongside the technical protections. You get the locked box and the legal agreement holding the courier responsible if anything goes wrong on their end.

When evaluating tools for your practice, ask one question: “Can your company read my patient data?” If the answer is anything other than a clear “no,” you are trusting a courier with an unlocked box.