http://it.toolbox.com/blogs/data-protection/delay-in-hipaa-audit-program-doesnt-mean-you-can-take-a-wait-and-see-approach-to-risk-management-65923