Pulling it together : high-risk pools can manage HIPAA compliance costs by taking a step-by-step approach