An entity may make a record of, use or disclose protected information if: