In which of the following circumstances must an individual be given the opportunity to agree or object to the use and disclosure of their PHI?