Sean Smith, Systems and Security Manager: “We have a HIPAA program in place, so we’re covered.” Not Quite…