In general terms, you could explain that you secure patient information by:
Encrypting PHI at rest and in transit (if that is the case)
Only storing PHI on internal systems protected by firewalls.
Storing charts in secure locations they can only be accessed by authorized individuals.