SESKStuff Everyone Should Know
SESK: Stuff Everyone Should Know · sesk.info/hipaa-required-vs-addressable

What does addressable mean in the HIPAA Security Rule?

It means assess and implement if reasonable, or document an equivalent.

Start playing free

  1. It is optional
  2. Only large hospitals must do it
  3. Assess it, then implement it or document why not ✔

Why: Addressable specifications must be assessed for reasonableness. If not reasonable, the entity must document why and implement an equivalent alternative if reasonable.

Huh, didn't know that: Required specifications must be implemented as written.

The dad joke
Addressable is like a fire drill: you can choose a different exit, but you still need a plan.
Like this card?
Play the game

References

Answer: Assess it, then implement it or document why not. Addressable specifications must be assessed for reasonableness. If not reasonable, the entity must document why and implement an equivalent alternative if reasonable.

  1. 45 CFR 164.306(d)(2) www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.306
    Assess whether each implementation specification is a reasonable and appropriate safeguard in its environment
    Checked 2026-10-10.

Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.

Test yourself in the game

Work SkillsWhat is electronic protected health information, or ePHI?Work SkillsWho must comply with the HIPAA Security Rule?Work SkillsWhat are administrative safeguards in the HIPAA Security Rule?

That's stuff everyone should know.