brian is the information security training officer for a health care provider. he wants to develop a training program that complies with the provisions of health insurance portability and accountability act (hipaa). which of the following topics must be included?
