As patrick notes most the Security Rule is mainly just a lot of documentation that has to be written. If you have even a little security background you probably have a good technical handle on it already (encrypted in transit, encrypted at rest, have good access controls, etc). Specifically it feels like a way for non technical people to track whether an organization is doing anything in regards to security. Keep in mind though since these policies and procedures are what you hand an HHS auditor when they come knocking you better have them in some fashion. Even a little documentation turns the conversation from "willfully neglected x,y, and z" into "You need to improve on x, y, and z". If you are interested in a fairly comprehensive checklist tool check out this little program from NIST http://scap.nist.gov/hipaa/
I am not a lawyer, not legal advice, etc etc
--------- Personal opinions and speculation
Keep in mind that in order to fall under HIPAA you have to use/store personally identifiable health information.
If you are looking for an easy way out of HIPAA you might want to look up 'de-identified health information'. Essentially what this means is that if you strip out all identifiable data from your records you no longer fall under HIPAA regulation, which may be useful if your company is doing statistical analysis of flu trends but probably less helpful if you need to be able to piece the data back together. I believe there are officially 18 or 19 pieces of information that make information personally identifiable.
As another note, once PHI is encrypted it is no longer considered PHI. It's my own opinion that you could probably leverage cloud services for a lot of operational work such as automated backup storage as long as you carefully encrypt everything before it hits any disk. Food for thought