Health care enterprises are required to guard protected health information and implement policies and procedures whether it be in paper or electronic format.