How well are healthcare organizations protecting patient information