Used by the organization to ensure that sensitive patient data and medical records are protected adequately.