Health care providers, health plans and their business associates are prohibited from using or disclosing PHI when the PHI is requested to conduct a criminal, civil, or administrative investigation ...