As long as patient information is not contained on NSU forms or records, it is not PHI and therefore not governed by the privacy rule and policies. true or false