HIPAA compliance: At the floor of security requirements, not the ceiling