HIPAA outlines other situations for which specific authorization for release of PHI is not required