If Bravo wanted to see for himself whether SSRH’s cardiovascular program was in fact at risk of being found out of compliance with Medicare’s conditions of participation, how should he go about getting relevant patient documentation without violating the privacy requirements of HIPAA?