Identify the 2 ways in which a covered entity must disclose protected health information (PHI). To significant others of an individual when requested. To Health and Human Services when undertaking a compliance investigation or review or an enforcement action To health insurance companies when requested. To individuals specifically when they request access to their PHI.