A baseline security policy for distributed healthcare information systems