essential policies and steps for preventing medical identity theft