Acovered entity must obtain the individual's written authorization to use or disclose: a. phi for treatment, payment and health care operations b. phi to the individual who is the subject of the information c. psychotherapy notes d. phi for public interest and benefit activities.

A. PHI for treatment, payment and health care operations

D. PHI for public interest and benefit activities.

Explanation:

PHI, Protected Health Information. The Privacy Rule protects all "individually identifiable health information" held or transmitted by a covered entity or its business associate, in any form or media, whether electronic, paper, or oral. The Privacy Rule calls this information "protected health information (PHI)."12

“Individually identifiable health information” is information, including demographic data, that relates to:

the individual’s past, present or future physical or mental health or condition,

the provision of health care to the individual, or

the past, present, or future payment for the provision of health care to the individual,  

-source, Family Educational Rights and Privacy Act, 20 U.S.C. §1232g.

Upon this policy, a covered entity is bonded by law to obtain the written consent of an individual's information under its custody to the media or any other third party. it should be disclosed under the following purposes

1. to the individual  PHI for treatment, payment and health care operations

2.Incident to an otherwise permitted use and disclosure;

(3) Public Interest and Benefit Activities; and

(4) Limited Data Set for the purposes of research, public health or health care operations