Suppose that in a US county the County Board of Commissioners wants to engage a retired physician to look into the county ambulance dispatch system to see what it takes to create proper records and successful billing. In the US, the HIPAA rules restrict to whom and under what conditions a health care provider or facility can disclose Protected Health Information (PHI). But such information can be disclosed provided the rules are complied with.
What do the HIPAA rule say needs to be done in such a case to allow such a person to look at protected health information (PHI), review records and billing/coding without violating privacy, and specifically to comply with the HIPAA privacy rule?