a patient requests that disclosures made from her medical record be limited to specific clinical notes and reports. given hipaa requirements, how must the hospital respond?