for HIPAA implementation specifications that are addressable, the covered entity___________.
a. implements the specification
b. may choose not to implement the specification if it is too costly to execute
c. must conduct a risk assessment to determine if the specification is appropriate to its environment
d. does not have to implement the specification if it is a small hospital
Answer: c