Describir: Beyond the HIPAA privacy rule