In which of the following situations is a disclosure of protected health information (PHI) not required based on the HIPAA privacy rule?​