Joshua is a dental assistant and receives a call from xyz insurance company requesting a copy of several patients' charts for an audit of the plan in which the dentist participates. he agrees to send the information because he believes it's okay under the hipaa. he speaks with the office manager, mary, and she says that the insurance company has to sign a trading-partner agreement and get each patient's specified consent. who would be acting correctly within the hipaa privacy regulation?