Responsibilities of covered entities and business associates