A covered entity may use or disclose PHI only:
- With the consent of the individual for treatment, payment, or health care operations;
- With the authorization of the individual for all other uses or disclosures;
- As permitted under this rule for certain public policy purposes.