Explanation

Health Insurance Portability and Accountability Act (HIPAA) Defines two types of controls – required and addressable. Required controls are mandatory for covered entities but for ‘addressable’ controls entities need to assess whether each implementation specification is a reasonable and appropriate safeguard in its environment, when analyzed with reference to the likely contribution to protecting the entity’s electronic protected health information.