Medical billing companies, healthcare providers, and business associates must track who accesses protected health information (PHI)—but many fail to do so correctly.