I am not a lawyer. In my experience, HIPPA does not provide any spec. It is akin to "did/do you have reasonable precautions for X?" so every organization is di

I am not a lawyer. In my experience, HIPPA does not provide any spec. It is akin to "did/do you have reasonable precautions for X?" so every organization is different, though many go to the extreme under HIPPA, because it providing documentation you had documentation, or documented you provided the document ad nauseam. It has little do do with how to mangle a document. That said, HIPPA does have something: it persuades cynicism and paranoia. Two words which make cautious.