The Ontario Information and Privacy Commissioner released an order today (Order HO-004) to Toronto's Hospital for Sick Children following the theft of a laptop containing personal health information. Her closing comment: "There is no excuse for unauthorized access to personal health information due to the theft or loss of a mobile computing device - any PHI contained therein must be encrypted."
The Order goes into considerable depth concerning the obligations of Health Information Custodians with respect to a number of issues. Its worth the read. If time is an issue the press release provides a good summary.