Which hipaa standard requires providers and their business associates to put in place policies and procedures that ensure privacy of the health record?.