An athlete who is seeking a second opinion wants his medical records to be sent to his new physician. What is the appropriate procedure to ensure the athlete's privacy/confidentiality?