Questions addressing various parts of assuring PHI access poses minimal risk