HIPAA uses a flexible standard in which companies are expected to select security measures based on "reasonably anticipated threats" and in line with the size of their organization and the costs of security measures (45 C.F.R. 164.306). Why do you think policymakers opted for this approach instead of one that would hold all organizations to the same standard? What are the benefits of this approach? What are the drawbacks? Does it make sense that smaller organizations have lower expectations than larger ones, when both might collect and use the same protected health information?