Subsequent to the enactment of the Security Rule, NIST revised its recommendations for enforced password expirations. The organization found that when users were forced to change passwords, they often changed just one character so the password was still easy to remember (for example, “password100” to “password 101”). This was considered to be unsafe because, if the original password had been compromised, there was a strong likelihood the new one would be as well. The current guidance from NIST is that passwords should only be changed when there is evidence that the password has been compromised, or is weak, shared, or re-used. Although there have been no subsequent changes made to the HIPAA password expiration requirements, it is important to note the requirement to implement “procedures for creating, changing and safeguarding passwords” is addressable and Covered Entities have the option of not implementing the requirement if it is unreasonable or inappropriate. However, the decision not to implement enforced password changes must be documented.