how does your boss respond to the question 'are you HIPAA compliant?' when he's selling your software?