HIPAA - When does it need to be signed?