What does implementation specifications mean?
There are two types of specification, those that are required and those addressable. If it is a required implementation specification, it must be implemented. If it is addressable, a covered entity must assess whether each is a reasonable and appropriate safeguard, AND, implement if reasonable and appropriate, OR document why it would not be reasonable and appropriate, AND implement an equivalent alternative measure if reasonable and appropriate.
