(a) not permit personal health information to be examined or copied without being satisfied as to the identity of the individual making the request, and

(b) take reasonable steps to ensure that any personal health information intended for an individual is received only by that individual.