; or (B) a person to whom a covered entity discloses an individual’s personal information for processing pursuant to a written contract, provided that the contract prohibits the person receiving the personal information from— (i) selling or transferring the personal information to a third party