on prohibits a covered entity from disclosing covered information with the consent of the customer, where the consent is express, in written or electronic form, and specific to the purpose and to the person or entity seeking the information. (5) Nothing in this rule prevents a covered entity from disclosing, in response to a subpoena, the name, address and other contact information regarding a cus