Why doesn t the security standard select specific technologies to be used?
To select a specific technology to satisfy the security requirements found in HIPAA would tend to bind the healthcare community to systems and/or software that may soon be superseded by rapidly developing technologies and improvements. The security standard was developed with the intent of remaining technologically neutral to facilitate adoption of the latest and most promising developments in this dynamic field and to meet the needs of healthcare entities of different size and complexity. The security standard is a compendium of security requirements that must be satisfied. The particular solution will vary from business to business but each will need to meet the basic requirements for secure electronic access, storage, and transmission of patient identifiable information.
