HHSHIPAASecurity RuleEASYFree question
What is the difference between a 'required' and an 'addressable' implementation specification?
- A.There is no difference
- B.Required applies only to large entities; addressable applies to small ones
- C.Required must be implemented; addressable must be assessed and an equivalent measure implemented if the specification is unreasonable
- D.Addressable specifications are optional and may be ignored
Why C is correct
Required specifications must be implemented. Addressable specifications require an assessment; if unreasonable, the entity must document why and implement an equivalent alternative.
Know someone studying for HIPAA? Send them this one.