Implementing The Privacy Rule