Acovered entity may use or disclose phi without an authorization, or documentation of a waiver or an alteration of authorization, for all of the following except:
a. use of decedents’ information, with certain representations by the researcher.
b. limited data set with an approved data use agreement.
c. activities preparatory to research, with certain representations by the researcher.
d. data that does not cross state lines when disclosed by the covered entity.

The best answer to the question: A covered entity may use or disclose PHI without an authorization, or documentation of a waiver or an alteration of authorization, for all of the following EXCEPT:___, would be, D: Data that does not cross state lines when disclosed by the covered entity.

Explanation:

When performing research, and especially when using people´s PHI (Protected Health Information), there are a lot of limits and requirements that must be met, in order to use any of that information. One of the most important issues here is the responsibility that research facilities, and researchers in general, have, of not disclosing private and protected information from a participant of any study, unless there is strict and written permission from the person, or an appropriate representative of that person. However, in the case of covered entities, HIPAA, which is the law that regulates the management of private health information, contemplates some exceptions to the rules. From the list provided here, all: A,B and C, are parts of the list of exceptions that HIPAA contemplates. However, D, is not one of them.