Covered entities have 10 business days (until July 22, 2016) to provide their responses
(1) Responses should contain the specified documentation-policies, procedures, evidence of implementation
(2) Provide complete and relevant materials
(3) Refrain from submitting superfluous documentation! 10MB file size limitation
In short, what HHS wants is VDE of compliance.
Without ALL three you are NOT in compliance with the respective Control/Audit Protocol Requirement. It is interesting that HHS is now using the word "Control" to refer to Security Rule implementation specifications.