It's true that patients have to provide an additional, specific authorization for training uses and disclosures of their information.
For any use or disclosure of protected health information that is not for treatment, payment, or health care operations or otherwise permitted or required by the privacy rule, a covered entity must seek the individual's written authorization.
Incidental uses and disclosures are not punishable if sufficient protections are in place and there is no carelessness.
To know more about patients :
https://brainly.com/question/18051445
#SPJ4