Protecting Health Information: the HIPAA Security and Breach Notification Rules