in terms of the hipaa privacy rule, which of the following is true regarding public health disease reporting?