An HMO sent a patient’s entire medical record to a disability insurance company without proper authorization. The authorization form used by the HMO did not comply with HIPAA’s requirements. Explain whether the HMO is a covered entity and why. Is an authorization needed in this instance? If you were the investigating officer, what other recommendations might you suggest?