Company XYZ is sometimes required to receive, process, store, and transmit Protected Health Information (PHI) generated by medical practitioners or as provided by the customer. The companys legal counsel has advised XYZ to be prepared to show compliance with what for PHI stored on computer systems in its field offices and in the operations center?

The HIPAA Security Rule