Under the Health Insurance Portability and Accountability Act (HIPAA), which of the following is considered a permitted disclosure without client authorization?