Does the Privacy Rule require that an authorization be notarized or include a witness signature?