§170.300 Applicability.
(a) The certification criteria adopted in this subpart apply to the testing and certification of Complete EHRs and EHR Modules.
(b) When a certification criterion refers to two or more standards as alternatives, use of at least one of the alternative standards will be considered compliant.
(c) Complete EHRs and EHR Modules are not required to be compliant with certification criteria that are designated as optional.
Make sure you are Omnibus Rule Compliant: HIPAA Privacy Checklist.