What should be included in a HIPAA IT compliance checklist