Because the HIPAA Security Rule applies to many different types of organizations, it was felt that if all the safeguards were “required” safeguards it would place an unnecessary burden on many Covered Entities. Consequently, the Security Rule requires Covered Entities to implement some safeguards, but allows a degree of flexibility with “addressable” safeguards if an existing or substitute measure achieves the objective of the safeguard with equal (or greater) protection, or it can be shown that the safeguard is not applicable in a specific scenario.