Comment by sizzle

How do you even report something this technical to non technical folks who oversee HIPAA? Would you have to do a case study style write up?