It’s a legal question more than a technical one. Let’s say you have a breach where PHI is exposed. If you can demonstrate you were adhering tightly to the guidelines, you’re less likely to receive jail time and a company-ending fine.

Sounds like your boss wants to roll the dice.