select all that apply: the hipaa privacy rule permits use or disclosure of a patient's phi in accordance with an individual's authorization that: