Secondary use[s] and disclosure[s] of protected health information (PHI) that cannot reasonably be prevented, limited in nature and that occur as a byproduct of an otherwise permitted use or disclosure.