I should have said "there is a government mandated method, but that's not the only way" It's more of a starting point than anything else. Also if you get HIPAA audited you either have to follow the government way (easiest for broke startups) or go the expert way but that is a bit more costly to prove out.