Bob recently accepted a position as the information security and compliance manager for a medical practice. which regulation is likely to most directly apply to bob's employer?