what are two required elements of an authorization needed to disclose phi? the authorization should have a right to revoke and an expiration date