It is a HIPAA & HITECH Meaningful Use Mandate. Small Practices, large health systems, business associates must comply. Conduct a risk analysis exercise annually.