Unless a HIPAA authorization is on file signed by the patient, a patient's PHI can never be disclosed in connection with a Medicare audit of a NSU clinic. true or false