An MFT in private practice keeps some of her clinical records on her laptop computer, which she carries back and forth to work every day. One evening after work she stopped to meet a friend for dinner before going home. When she returned to her car she noticed the trunk was open and then found that her computer had been stolen. The clinician kept only her psychotherapy notes on her laptop. All client-identifying information (PHI) was kept in her office in locked file cabinets. According to the Security Rule: Select one: