A new standard spells out detailed controls for managing health information security.