Which of the following statement(s) would be permitted uses and disclosures of a patient’s protected health information (PHI)?

I. A healthcare provider may disclose PHI when the disclosure of that PHI is used for its own treatment, payment, and health care operations activities

II. A healthcare provider may have disclosures of PHI that are incidental or “incident to” an otherwise permitted use or permitted disclosure, so long as the provider has adopted reasonable safeguards

III. A healthcare provider may release a patient’s PHI if the patient has provided a written authorization from the patient that meets the requirements set forth in the Privacy Rule

a.I

b.II

c.I and II

d.I, II, and III