What the Change Healthcare Attack Should Have Taught Every Covered Entity