HIPAA’s blessing is also a curse. It’s specifically designed to be flexible, which allows its requirements to apply to organizations of all sizes—from single-physician practices to national healthcare chains. But, that flexibility means HIPAA requirements can be purposely ambiguous.