"The FAQ guidance includes an example illustrating permitted sharing of PHI [involving] a situation in which Plan A discloses PHI about an individual to Plan B (a separate CE). In this situation, Plan B does not need the individual's authorization to send communications to the individual about Plan B's health plan options that may replace the individual's current plan ... However, this assumes that Plan B: [1] Does not receive remuneration for sending the communication to the individual. [2] Complies with any controlling HIPAA business associate agreement[.]"