The Privacy Rule has broad administrative requirements.

Designate a security officer.

Document termination procedures.

Use biometrics to authenticate transactions.

Deploy tokens and smart cards to all medical personnel.

Verify that business associates treat patient information respectfully.