The health insurance portability and accountability act (hipaa) restricts the use of protected health information (phi) to treatment, diagnosis, and:_________