A hospital would like to search its electronic patient database by the "date" field and send a Fundraising Gala invitation to every patient who was discharged after October 1, 2012 but before February 1, 2014. Is this permissible or do they need authorization?

A medical center would like to use a full-facial photograph of a particularly handsome former pediatric patient in its Fundraising Gala invitations. Is this permissible or do they need authorization?

The cardiologists at Hospital X want to improve the health of future Hospital X patients who undergo heart surgery. For that purpose, the cardiologists will review old medical records of former cardiology patients and use the information to develop clinical guidelines that will be followed in future cardiac surgeries at Hospital X. Is this permissible use of PHI for health care operations under 45 C.F.R. 164.506(c)(1) or research activity regulated under 45 C.F.R. 164.512(i)?

Please provide any reading material I need to understand better