This is what I found most relevant:
"HHS recognizes that covered entities range from the smallest provider to the largest, multi-state health plan. Therefore the Security Rule is flexible and scalable to allow covered entities to ana
lyze their own needs and implement solutions appropriate for their specific environments. What is appropriate for a particular covered entity will depend on the nature of the covered entity?s business, as well as the covered entity?s size and resources. Therefore,
when a covered entity is deciding which security measures to use, the Rule does not dictate those measures but requires the covered entity to consider:
Its size, complexity, and capabilities,
Its technical, hardware, and software infrastructure,
The costs of security measures, and
The likelihood and possible impact of potential risks to e-PHI."
Bold added.
The source for the quote is the following reference in the CMS description of the rule:
http://www.hhs.gov/ocr/privacy/hipaa/understanding/srsummary.html
