Refereed paper: A baseline security policy for distributed healthcare information systems