The Security Rule has “required” and “addressable” implementation specifications because some implementation specifications may not be reasonable or appropriate in all circumstances. In such circumstances, an addressable implementation specification allows Covered Entities to implement an alternative measure, provided the alternative measure is at least as effective and the reason for implementing it is documented.