A covered entity is permitted, but not required, to use and disclose protected health information without an individual’s authorization for the following purposes or situations:
•To the individual (unless required for access or accounting of disclosures).
•Treatment, payment, and health care operations.
•Opportunity to agree or object.
•Incident to an otherwise permitted use and disclosure.
•Public interest and benefit activities.
•Limited data set for the purposes of research, public health, or health care operations.
Covered entities may rely on professional ethics and best judgments in deciding which of these permissive uses and disclosures to make.