When you have a few moments, please review the article below . It addresses both the Privacy and Security Rules. It also segregates the "required" versus "addressable" provisions. When reviewing the regulatory provisions in a snapshot format such as this, does it surprise you to see the number of implementation specifications under the Security Rule that are merely "addressable?" Assume that you handled HIPAA compliance at a covered entity consisting of 100 employees providing health care services. Would there be any of the "addressable" specifications that you would feel comfortable advising the employer they did not need to implement? If so, which ones? If not, then would there be any type of covered entity for whom you would advise there was no need to adopt any of the "addressable" requirements? Why or why not?

https://www.hipaajournal.com/hipaa-compliance-checklist/