When potential risks and vulnerabilities are identified, covered entities and business associates are required to implement security measures sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level. In order to determine what constitutes a “reasonable and appropriate level”, organizations should take into account (per 45 CFR § 164.306(b)):
The size, complexity, and capabilities of the organization
The organization´s technical infrastructure, hardware, and software security capabilities
The cost of reasonable and appropriate security measures
The probability and criticality of potential risks to the integrity of ePHI