As part of a research study, a physician plans to review medical records of the next 50 of her patients who require magnetic resonance imaging (MRI) scans for clinical treatment. The physician will review the medical records, and write down the clinical indication for the scans, any existing injuries, current prescriptions, as well as other clinical data. The clinical indication for the scans and the other clinical data will be collected in the medical records for treatment purposes as part of standard clinical care. The physician will use a coding system to be able to identify the patient's information; however, the "key" to the coding system will be stored separately from the data in a locked cabinet that only she will have access to. Which of the following is true?