Under HIPAA, a covered entity may disclose a patient's protected health information (PHI) without written authorization for which of the following purposes?