Source: http://www.compliancelawjournal.com/compliancelawjournal/issue_1?pg=59
Timestamp: 2019-04-21 11:17:07+00:00

Document:
The foregoing rules structure makes clear that, while covered entities and business associates are free to implement security protections tailored to their own circumstances, they must be able to defend their decisions. Those decisions, particularly regarding the “addressable” measures, may draw rigorous scrutiny moving forward because it is one of the few tools HHS has to incentivize increased cybersecurity measures. Thus, it is important to understand the implementation safeguards currently set out in the Security Rule.
41. Id. § 164.306(d)( 1) (2013).
43. Id. §164.306(d)( 3)( i) (2013).
44. Id. § 164.306(d)( 3)( ii) (2013).
46. Id. § 164.308(a)( 1)( ii)( B) (2013).
47. Id. § 164.308(a)( 1)( ii)( A) (2013).
48. Id. § 164.308(a)( 1)( ii)( C)–(D) (2013).

References: § 164
 §164
 § 164
 § 164
 § 164
 § 164