Under HIPAA rules, implementation specification under the security rule related to encrypted electronic mail that contains the patient’s protected health information. The provider must implement the specification as stated in the rule, implement protections equivalent to the rule, or clearly document why the implementation specification does not apply.