the _______ governs how covered entities must protect and/or disclose phi, and governs how phi may be used and shared, providing clarity to patient rights.