What does HIPAA say about the security of health records in a medical institution?

HIPAA does not address information security; it only addresses access to medical information.

HIPAA says that every institution must have a complex security system and full-time guards.

HIPAA says that every institution must have a security plan that they enforce.

HIPAA outlines the exact security measures required by each type of institution.