Which of the following statement(s) would be permitted uses and disclosures of a patient’s protected health information (PHI)?
I. A healthcare provider may disclose PHI when the disclosure of that PHI is used for its own treatment, payment, and health care operations activities
II. A healthcare provider may have disclosures of PHI that are incidental or “incident to” an otherwise permitted use or permitted disclosure, so long as the provider has adopted reasonable safeguards
III. A healthcare provider may release a patient’s PHI if the patient has provided a written authorization from the patient that meets the requirements set forth in the Privacy Rule
c.I and II
d.I, II, and III