Addressable vs required safeguards (HIPAA Security Rule)

Under the HIPAA Security Rule, a practice must implement a required implementation specification as written. For an addressable one, the practice must assess it and then either implement it, implement an equivalent alternative, or document why neither fits. The distinction applies only to the Security Rule's implementation specifications for electronic protected health information (PHI) and ePHI. It does not apply to the Privacy Rule or the Breach Notification Rule. Addressable does not mean optional. It means "decide and document."

In practice at a clinic or small practice

Office managers and privacy officers usually meet this term while working through the practice's security risk analysis. Some items on that list are required and non-negotiable. The risk analysis itself is one. A unique login for every staff member is another, so a shared "frontdesk" account on the check-in computer is not acceptable.

Addressable items show up as decisions, not checkboxes. Typical questions:

• Should the front desk workstation log off automatically after a set idle time?
• Should laptops and phones that hold ePHI be encrypted?
• Should messages staff send each other be encrypted in transit?

For each item, the practice writes down what it chose and why. It keeps that record with the rest of its HIPAA documentation.

Not to be confused with

• Optional. This is the most common misreading. A practice cannot simply skip an addressable safeguard. Leaving one out without a documented assessment is a compliance gap.
• Administrative, physical and technical safeguards. These are categories of safeguards. "Required" and "addressable" describe the status of an individual implementation specification within any of those categories, so a safeguard in any category can be either. For example, unique user identification and encryption are both technical safeguards, but the first is required and the second is addressable.
• Standard vs implementation specification. Every standard must be met. The required or addressable label applies only to the implementation specifications listed under a standard.

What the rules say

The primary source is 45 CFR 164.306(d), within "Security standards: General rules," which governs implementation specifications. The full set of standards is covered in the HIPAA Security Rule entry.

For an addressable specification, the covered entity or business associate must work through these steps:

1. Assess whether the specification is reasonable and appropriate for its environment, considering how likely it is to protect ePHI.
2. If it is reasonable and appropriate, implement it.
3. If it is not, document why. Then implement an equivalent alternative measure if that alternative is reasonable and appropriate.

When making that assessment, the entity may weigh these factors:

• Its size, complexity and capabilities
• Its technical infrastructure, hardware and software security capabilities
• The cost of security measures
• The probability and criticality of potential risks to ePHI

Cost alone is not a reason to skip a safeguard. It is one factor in a documented decision.

Proposed change. HHS has proposed amending the Security Rule to remove the addressable category and make most implementation specifications required, with limited exceptions. It was published as a proposal, not a final rule. Check its current status before you change your policies.

This entry is general information, not legal advice. Ask your privacy officer or counsel how these rules apply to your practice.

Related reading

The Security Rule and PHI entries linked above cover the full set of standards and what they protect. For more:

• Healthcare operations glossary
• How a staff chat vendor documents its security safeguards