You are a security engineer for a hospital group based in Cincinnati, OH. Your group has just acquired a small hospital in Alba, IA. Currently, everything except insurance billing is done on paper forms. The company CSO has asked you to draft a memo that gives an overview of what will be necessary to bring this small hospital into HIPAA security compliance.