HIPAA Security Rule: 'Addressable' Does Not Mean 'Optional'

HIPAA covered entities and business associates must formally document a risk-based rationale if they choose not to implement an 'addressable' security safeguard or an equivalent alternative.