The information is NOT received from a HIPAA-covered entity AND the person receiving the information is NOT a staff member of a HIPAA-covered entity, The information is part of the employment records ...