Under HIPAA, which of the following is considered a permissible disclosure of protected health information (PHI) without patient authorization?