https://csrc.nist.gov/pubs/sp/800/66/r2/final [HIPAA implementation]
https://www.hhs.gov/hipaa/for-professionals/security/guidance/guidance-risk-analysis/