Healthcare organizations must lock down identities and access to PHI