HIPAA Glossary · Security Rule concepts
Required vs addressable
Every Security Rule implementation specification is one or the other. Addressable never means optional.
Context
Defined at §164.306(d). Required means implement it. Addressable means implement it, implement a documented equivalent, or document why neither is reasonable and appropriate. The documented rationale is the compliance artefact; an addressable specification with no implementation and no rationale is a finding. The proposed Security Rule (RIN 0945-AA22) would remove the addressable qualifier for most specifications.
Related terms
- Security Rule — The HIPAA regulation requiring administrative, physical, and technical safeguards for ePHI.
- Risk analysis — The accurate, thorough assessment of risks to all ePHI the organisation holds — the foundational Security Rule requirement.
Where this fits
This is one of 50+ terms in the HIPAA Glossary. For how HIPAA is structured end-to-end, see the Security Rule guide and the Privacy Rule guide.