How will employees in the medical office have to be trained regarding privacy what is required if an employee doesn't follow the privacy policy when must employee trained in what manner?