['Put someone in charge.', 'Keep Protected Health Information (PHI) secure and private.', 'Set up office policy, implementation procedures and training for your staff.', 'Inform patients of their rights and support those rights.']