privacy rule compliance costs