Official guidance consulted: FTC Privacy & Security guidance and HHS HIPAA guidance for covered entities/business associates.