Covered entities are not implementing risk management plans to reduce risks to protected health information (PHI) to an acceptable and appropriate level.