Which federal program sets specific medical record retention requirements that compliance officers must consider?