Absolutely correct. Anyone who tells you that HIPAA requires you to do XYZ is full of shit. The difficulty with HIPAA is that it sets a very basic framework tha

Absolutely correct. Anyone who tells you that HIPAA requires you to do XYZ is full of shit. The difficulty with HIPAA is that it sets a very basic framework that you have to fill in with your own policies and procedurs. How strictly you follow your own procedures is what will get you in hot water.