Policy and its impact on medical record security