Every standard in the HIPAA Security Rule comes with implementation specifications, and each one is marked either required or addressable. Those two words cause more confusion in small practices than almost anything else in the rule.
What the words mean
Required means do it. No analysis, no exceptions.
Addressable means assess whether it is reasonable and appropriate for your practice, and then do one of three things:
- Implement it; or
- Implement an equivalent alternative, and document why; or
- Document why neither is reasonable and appropriate, and how the standard is still met.
Addressable does not mean optional. It means "justify in writing."
Why the third option rarely holds up
Encryption is a good example. It's an addressable specification, but it's free and built into every modern operating system. Arguing that it isn't reasonable for your office is very hard to defend. OCR settlements repeatedly cite organizations that treated addressable as optional and had no documentation at all.
The flexibility the rule does give you
The Security Rule is deliberately scalable. It lets you choose measures based on your size, your technical capabilities, the cost of the measure, and how likely and serious a given risk is. A ten-person practice is not expected to run a 24-hour security operations center.
What it is expected to have is a documented, defensible decision about what it does instead. The flexibility is permission to be proportionate, provided you wrote down the reasoning. It is not permission to do nothing.
The practical answer for a small office
Implement essentially all of the addressable specifications. With today's tools, doing them usually costs less than writing and defending a credible exception.
This may change anyway
In January 2025, OCR proposed an overhaul of the Security Rule that would remove the distinction and make every specification required. As of this writing it has not been finalized, and its timeline has slipped repeatedly. Verify the current status with HHS before relying on any date. A practice that already implements the addressable items won't have to rework anything if it passes.