the entity discloses the protected information to: