. "Employees should be acutely aware of the types of information that are considered PHI within their organizations and the types of controls necessary to protect it." . . .