Defining a process for gathering information pertaining to a hipaa