disclose protected information to a person mentioned in subsection (2); and