Although a particular communication under the Privacy Rule may not require patient authorization because it is not marketing, or may require patient authorization because it is ???marketing??? as the Rule defines it, the arrangement may nevertheless violate other statutes and regulations administered by HHS, the Department of Justice, or other Federal or State agency.