. "NPPs now must include a description of the types of uses and disclosures of PHI that require an authorization pursuant to the Privacy Rule." . . .