An addressable HIPAA implementation specification is not optional. You must assess whether it is a reasonable and appropriate safeguard in your environment. If it is, implement it. If it is not, document why and adopt an equivalent alternative where appropriate. Only a required specification skips the assessment and goes straight to implementation.
What the regulation says
Section 164.306(d) labels each implementation specification either Required or Addressable. For required items you implement them. For addressable items you first decide whether the specification fits as a way to protect ePHI in your setting.
Then there are two paths. If it fits, you implement it. If it does not, you write down the reasons and, if appropriate, put in place an equivalent measure.
That is the whole rule. Nothing in it lets you shrug and skip.
The flexibility behind it
Section 164.306(b) lets covered entities and business associates choose measures that suit their circumstances. The factors named are size, complexity and capabilities, existing technical security features, the cost of each measure, and the probability and criticality of risks to ePHI.
Cost is on the list, but it is one factor among several. It does not outrank risk.
What a good addressable decision record looks like
Keep it short and specific. For each addressable item:
- Name the specification and the system in scope.
- State the risk it addresses.
- State your decision: implemented, implemented in part, or alternative.
- If alternative, describe the alternative and why it gives comparable protection.
- Add the date, the approver and the next review date.
A line such as "too expensive" does not hold up. "The device cannot support automatic logoff, so we compensate with a locked room, badge access and a shorter lock screen timeout on the connected workstation" is a real alternative.
Common addressable items in the technical safeguards
Automatic logoff, encryption and decryption, mechanism to authenticate ePHI, and the integrity and encryption specifications under transmission security are all addressable. In practice, encryption is hard to argue away, because the alternative has to give comparable protection.
Keep the records alive
Decisions age. A cloud migration, a new device type or a new vendor changes the answer. Review addressable decisions whenever your risk analysis changes. Related reading: HIPAA encryption at rest and in transit.
Quick check
Can I just skip an addressable specification?
No. You have to assess it, then implement it or document why it is not reasonable and appropriate, adding an equivalent measure if appropriate.
Does cost alone justify skipping one?
Cost is one factor in the flexibility rule, alongside size, technology and risk likelihood and impact. Cost alone is a weak justification.
Sources
Last reviewed: 19 October 2026.
