Department of Health and Human Services requires physical security for HIPAA compliance of devices accessing electronic patient health information