Covered entities (CEs) and business associates (BAs) may receive a “discount” for having recognized security practices (RSPs) ...