How a HIPAA ‘safe harbor’ could change data breach consequences