Do the HIPAA security rules apply to faxing out of EMRs