Under the privacy rule the patient has the right to request what or obtain copies of his or her health records