The disclosure and use of PHI by a covered entity is permissible but not required in the following circumstances:
- For a treatment, payment, or healthcare operations
- For public interest and benefit activities
- To the individual who is subject to the information
- Where opportunity is given to the individual to agree or object
- Incidental use and disclosure.