Given the increased number of ransomware attacks on health care entities and their business associates, the focus has changed from what to do