HIPAA allows the use and disclosure of PHI for treatment, payment, and health care operations