What is a doctor’s responsibility if a patient requests restrictions on the use of his or her PHI