A hospital shall adopt and implement reasonable safeguards for the security of all health care information it maintains.