An entity may disclose protected information if: