"The [proposed rule] would clarify that a business associate is required to disclose PHI to the covered entity so the covered entity can meet its access obligations.... [and] would require changes to the notice of privacy practices.... [A] health plan would have to act on a request for access to inspect or obtain a copy of PHI in a shorter timeframe, namely 15 days after receipt of the request.... [The proposed rule] would require health plans to post fee schedules on their website for common types of requests for copies of PHI and, upon request, provide individualized estimates of fees for copies."