The HIPAA Security Rule requires that all Covered Entities must perform “periodic security updates” and have “procedures for guarding against, detecting and reporting malicious software”