As a healthcare firm you are highly regulated and sensitive date must be protected to ensure safeguarding PII and PHI and may also need to achieve and maintain HIPAA/HITRUST  and other privacy regualtions