The terms “reasonable” and “appropriate” are not defined anywhere in the Administrative Simplification provisions. However, according to CMS´ HIPAA Basics Guide, “what’s reasonable and appropriate depends on your business as well as its size, complexity, and resources”. Although this statement implies a degree of compliance flexibility, it should not be interpreted as a reason to take shortcuts with HIPAA compliance or omit standards that are difficult to comply with.