No. Addressable means you must check whether a safeguard is reasonable and appropriate for your organization. If it is, you implement it. If it genuinely isn't, you document why and implement an equivalent alternative measure instead, if one is reasonable and appropriate. The key word is instead, not skip. Skipping without documentation is not a compliance decision; it is a gap.
Here’s a conversation that happens in small medical practices every day.
The office manager is reviewing HIPAA rules. She sees that encryption is listed as an “addressable” implementation specification under the Security Rule. She looks it up. She reads that addressable means the organization can assess whether it’s “reasonable and appropriate” given its situation. She concludes: optional. She moves on.
Six months later, a laptop gets stolen from a staff member’s car. The hard drive wasn’t encrypted. Breach notice follows. Then an OCR review. Then a fine.
University of Rochester Medical Center paid $3 million for losing an unencrypted laptop and flash drive. MD Anderson Cancer Center was hit with $4.3 million in penalties over unencrypted laptops and thumb drives, though the Fifth Circuit vacated that penalty in 2021 after finding OCR had miscalculated the statutory caps and that MD Anderson had in fact implemented encryption (University of Texas M.D. Anderson Cancer Center v. HHS, 985 F.3d 472 (5th Cir. 2021)). Fresenius Medical Care settled for $3.5 million over five separate breaches involving stolen unencrypted devices.
This is one of the most expensive misunderstandings in healthcare compliance, and HHS has proposed a rule that would take it off the table.
What “Addressable” Actually Means Under the HIPAA Security Rule
When HHS wrote the HIPAA Security Rule back in 2003, they created two categories of implementation specifications: required and addressable.
Required was simple: you must do it. Full stop.
Addressable was more nuanced. It meant: you must assess whether this safeguard is reasonable and appropriate for your organization. If it is, you implement it. If it genuinely isn’t (because of your size, technical capabilities, or risk profile), you document why, and you implement an equivalent alternative measure instead, if one is reasonable and appropriate.
The key word there is instead. Not “skip.” Not “defer until later.” Not “ignore entirely.”
The original intent was flexibility, not exemption. A solo physician in a paper-based rural practice might have a different encryption story than a 200-person multi-specialty group. HHS wanted to accommodate that reality without a one-size-fits-all mandate.
What they got instead was widespread confusion, and a lot of practices treating “addressable” as a polite way of saying “optional if you don’t feel like it.”
Which HIPAA Safeguards Are “Addressable” (and Why That Matters)
The Security Rule marks more than 20 implementation specifications as addressable. You probably recognize some of them:
- Encryption of ePHI at rest and in transit (§ 164.312(a)(2)(iv) and § 164.312(e)(2)(ii))
- Automatic logoff from workstations (§ 164.312(a)(2)(iii))
- Log-in monitoring: procedures for monitoring log-in attempts and reporting discrepancies (§ 164.308(a)(5)(ii)(C))
- Password management: procedures for creating, changing, and safeguarding passwords (§ 164.308(a)(5)(ii)(D))
- Security reminders: periodic security updates for your workforce (§ 164.308(a)(5)(ii)(A))
Notice what’s on that list: encryption, automatic logoff, log-in monitoring, password management, security reminders. These are not exotic cybersecurity measures: they’re basics. And for years, practices have been skipping them because they misread the word “addressable” as “optional.” Some safeguards people assume are addressable are not addressable at all: audit controls (§ 164.312(b)) and person or entity authentication (§ 164.312(d)) are Required standards today, and the security awareness and training standard itself (§ 164.308(a)(5)) must be met even though its four implementation specifications are addressable.
HHS has said as much publicly. In the proposed rulemaking published January 6, 2025, HHS wrote that it is “concerned that some regulated entities proceed as if compliance with an addressable implementation specification is optional.” In the next sentence it added: “That interpretation is incorrect and weakens the cybersecurity posture of regulated entities.”
That’s the federal government politely saying: you got this wrong, and people got hurt because of it.
The Documentation Requirement Most Practices Skip
If your practice ever did the addressable analysis correctly and decided a particular implementation specification wasn’t reasonable and appropriate for your situation, you were supposed to document that decision. In practice, that means writing down three things:
- Why the implementation specification is not reasonable and appropriate for you (the standard itself still applies)
- What equivalent alternative you implemented instead
- How that alternative protects ePHI to the same degree
Show that documentation to an OCR investigator after a breach and you’re in fair shape. Show up with no documentation, no analysis, and no alternative measures (just a blank space where that safeguard should be), and you’re in a very different conversation.
Most practices that skipped addressable safeguards wrote nothing down. They just skipped. That’s not a compliance decision. That’s a gap. And it’s the kind of gap that turns a manageable fine into a headline.
What’s Changing: The 2025 Proposed Security Rule
In January 2025, HHS published a Notice of Proposed Rulemaking that would substantially overhaul the HIPAA Security Rule, which was last revised in 2013.
The headline change: the proposal would remove the addressable/required distinction and make all implementation specifications required, with specific, limited exceptions.
Under the proposed rule, virtually every implementation specification would become mandatory. No more assessing whether encryption is “reasonable and appropriate” for your practice; it would be required. No more deciding that automatic logoff doesn’t fit your workflow; required. No more flexibility rationale.
New Specific, Measurable Requirements
The proposed rule would also add requirements that don’t exist today:
- Encryption of all ePHI at rest and in transit, consistent with “prevailing cryptographic standards” (with limited exceptions)
- Multi-factor authentication for the systems that hold ePHI
- A risk analysis reviewed and updated at least once every 12 months
- Penetration testing every 12 months
- Vulnerability scans at least every 6 months
- A written technology asset inventory and network map, reviewed at least once every 12 months
- Network segmentation rules
The comment period closed March 7, 2025. HHS’s regulatory agenda had targeted May 2026 for a final rule; that date passed, and the 2026 Unified Agenda now targets July 2027. If the rule is finalized as proposed, regulated entities would have 240 days after publication to comply. A coalition of industry associations led by CHIME has also petitioned HHS to withdraw the proposed rule, so the timeline could shift again. Either way, a later deadline is not a reason to wait.
Why You Should Act Now, Not When the Final Rule Drops
There are two reasons not to wait.
First, the current addressable rules already require more than most practices are doing. The proposed rule isn’t introducing encryption as a novel concept: it would make explicit that encryption was always the expectation unless you had a documented, justified reason otherwise. OCR can and does investigate practices under the current rules, and gaps in addressable protections absolutely factor into those reviews. Just ask the practices that paid millions over unencrypted laptops.
Second, getting in line with the proposed rule is a project, not a switch you flip. Implementing encryption across all devices, deploying MFA, setting up a real audit log system, running a proper risk assessment: this takes time and budget. Practices that start now will be ready when the final rule drops. Practices that wait for the final rule to publish will be scrambling.
What to Do Right Now: A 5-Step Action Plan
Step 1: Run an Honest Inventory
Go through the current list of addressable implementation specifications and ask yourself three questions for each one:
- Do we have this in place?
- If not, do we have documented justification for why not?
- If not that either, do we have an equivalent alternative that genuinely provides the same protection?
If the answer to all three is “no,” you have a gap. Document it, prioritize it, and start handling it before a breach forces the conversation.
Step 2: Encrypt Everything
For the full technical rundown, see our guide on encryption specifications under HIPAA.
Make sure encryption is happening on all devices (laptops, workstations, tablets, phones) and in all data transfers. Full-disk encryption (BitLocker for Windows, FileVault for Mac) is free and built into the operating system. There is virtually no defensible reason to leave devices unencrypted in 2026.
Step 3: Implement Audit Controls
Audit controls are not addressable: they are a Required standard today (§ 164.312(b)). You need to know who accessed what patient data, when, and from where. The proposed rule would also have you keep those records for a period that is reasonable and appropriate for each type of log.
Step 4: Train Your Workforce
Make sure your staff has received documented security training in the last 12 months. Not just a “we talked about it at a meeting.” Actual training with attendance records and a record of what was covered.
Step 5: Document Your Decisions
For any addressable implementation specification you haven’t fully implemented, write down your reasoning today. Even imperfect documentation is far better than none.
The Bottom Line on “Addressable” vs. “Required”
These aren’t novel rules. They’re the basics that the proposed rule would force practices to confront. The myth that “addressable” means “optional” has cost practices real money: millions in fines, millions more in breach costs. HHS has proposed removing the ambiguity for a reason.
The enforcement numbers speak for themselves. Over $8.3 million in HIPAA fines in 2025, with addressable safeguard gaps showing up in case after case. Do the work now, on your schedule, instead of later under pressure.
Key stat: The proposed HIPAA Security Rule (published January 6, 2025, and not final) would make all implementation specifications required, with specific, limited exceptions. Under the current rule, an addressable specification must be implemented when it is reasonable and appropriate; when it is not, you document why, based on your risk assessment, and implement an equivalent alternative measure if one is reasonable and appropriate.
Sources
Regulatory Updates
Related Reading
- 7 Key Changes Proposed for the HIPAA Security Rule: What would change, and where the timeline stands
- Does HIPAA Require MFA? What the current rule says and what is proposed
- How to Conduct a HIPAA Risk Assessment: The foundation of every compliance decision
- HIPAA Fines in 2025: Who Got Caught? Real enforcement cases and what triggered them
- HIPAA Increased Penalty Amounts in 2026: Updated penalty tiers you need to know
The myth that “addressable” means “optional” has cost practices real money in fines and breach costs. HHS has proposed removing the ambiguity for a reason. Get ahead of it.
Frequently Asked Questions
What is the difference between required and addressable safeguards under HIPAA?
Required safeguards must be implemented exactly as specified, no exceptions. Addressable safeguards require a documented assessment: if the safeguard is reasonable and appropriate for your organization, you implement it. If not, you must document why and implement an equivalent alternative measure if one is reasonable and appropriate. Neither category is optional.
Can I skip an addressable HIPAA safeguard entirely?
No. You cannot simply skip an addressable safeguard. If you determine that a specific addressable specification is not reasonable and appropriate for your organization, you must document your reasoning and implement an equivalent alternative measure if one is reasonable and appropriate. Skipping without documentation is a compliance gap that OCR treats as a violation during investigations.
What penalties apply if we ignored addressable safeguards?
The same penalty tiers that apply to any HIPAA Security Rule violation. In 2026, penalties range from $145 per violation for unknowing violations up to $2,190,294 per violation category per year. University of Rochester Medical Center paid $3 million over a failure to implement encryption, an addressable safeguard it treated as optional. OCR also imposed a $4.3 million penalty on MD Anderson Cancer Center over the same issue, but the Fifth Circuit vacated it in 2021 (University of Texas M.D. Anderson Cancer Center v. HHS, 985 F.3d 472 (5th Cir. 2021)).
Is the 2025 proposed Security Rule final or still in progress?
It is still a proposal. It was published January 6, 2025, and its public comment period closed March 7, 2025. HHS’s regulatory agenda had targeted May 2026 for a final rule; that date passed, and the 2026 Unified Agenda now targets July 2027. If it is finalized as proposed, regulated entities would have 240 days after publication to comply. A coalition of industry associations led by CHIME has petitioned HHS to withdraw the proposal, so the timeline could shift again. Regardless, the current Security Rule already requires a documented assessment of every addressable specification.
How do I document addressable safeguard decisions correctly?
For each addressable specification, document three things: (1) your assessment of whether the safeguard is reasonable and appropriate given your size, technical capabilities, and risk profile; (2) if you determined it is not reasonable and appropriate, the specific reasons why; and (3) the equivalent alternative measure you implemented instead, if one is reasonable and appropriate, and how it protects ePHI. Keep this documentation as part of your Security Rule compliance records, updated whenever your environment changes.
Need help auditing your current safeguards or building a compliant security program? One Guy Consulting can help. Explore HIPAA compliance services