2.5 IMPLEMENTATION GUIDELINES

The Security rule specifies the standards that must be met to secure ePHI. The implementation specifications are either required or addressable. Required implementation standards must be applied by all covered entities. There are 22 required implementation specifications. Addressable implementation standards are applied in one of three ways:

Implement the standard if reasonable and appropriate
Implement and alternative measure that is reasonable and appropriate and document how this achieves alternative meets the standard
Do not implement the standard and document why it would not be reasonable and appropriate to implement the standard

Standards are required. Implementation specifications are reasonable and appropriate.

All covered entities must be aware that addressable does NOT mean optional. All standards must be implemented. This can be confusing and it may help to think of it from a medical perspective. In the past, penicillin was the standard medication to give for bacterial infections. Doctors prescribed this drug as a matter of best practices in health care. Some individuals are allergic to penicillin. Doctors prescribe an alternative antibiotic that is reasonable and appropriate to treat the infection. If the individual's allergies to antibiotics are so severe, the doctor will document why it is not reasonable and appropriate to implement antibiotics. Doctors document their decision in the individual's medical record

HIPAA standards work the same way. You must review each standard and document what actions your organization took to implement the requirements. These actions must be documented by your organization's security official and clearly indicate the factors supporting these decisions.