How the latest HIPAA events show the complexity of protecting data