Under HIPAA, which of the following is an example of a permitted disclosure of protected health information without patient authorization?