. . . "Notices of privacy practices must be updated to include a description of the types of uses and disclosures that require an authorization." . .