1.   Which one of the following requirements is outlined in the guidelines established in HIPAA's Privacy Rule?