Change SHOULDs to SHALLs

Since the national directory will not contain PHI, it is not subject to HIPAA regulations. In general, it would be inappropriate to require (e.g., SHALL) conformance to the security standards cited in the quoted paragraph.  The implementers may decide that conformance with other emerging standards is more appropriate.  It is also unlikely the BAAs will be required (again no PHI) but rather exchange of certain restricted data may rely on Data Use Agreements (DUAs) or their equivalent. We will solicit feedback on these requirements in the next round of balloting. Since the national directory will be providing information to a large number of distributed directories, many of which will have unauthenticated access to public data, it would not be appropriate for them to be required to either request or maintain provenance resources.  In fact, there is no intent to require the national directory to produce provenance resources.  Instead, the directory will supply verification resources upon request.