Encrypting data on the devices is the most effective measure to protect the stored information because it ensures that even if the device is lost or stolen, the patient data remains inaccessible without the appropriate decryption key. Regularly changing Wi-Fi passwords, while a good security practice, does not directly protect the data on the devices themselves. Implementing a firewall protects against network-based attacks but would not prevent access to data if the device is compromised. Disabling unnecessary services reduces the attack surface but would not protect the data that is already on the device.