joe researcher asks for access to patient records as part of a research project. what should the health information manager do?