HIPAA Implementation: the Case for a Rational Roll-out Plan