$750K HIPAA settlement highlights importance of risk analysis, device control policy September 3, 2015