are the technology, and the policy and procedures for its use that protect electronic protected health information and control access to it.