A doctor is sending a patient’s lab work to a lab That is an external business partner. The lab and the
doctor’s staff are all trained on the doctor’s Privacy Practices. The doctor has a signed Notice from the
patient. In order to use or disclose PHI, the lab MUST: