One year after the Change Healthcare breach, it’s time to look at what changed, what didn’t, and what must.