Under HIPAA, the Privacy Rule allows covered entities to use or disclose protected health information without the individual's permission for the following purposes:

a. to the individual for treatment, payment and health care operations as defined in the rule;

b. to certain governmental authorities if abuse, neglect or domestic violence is at issue for law enforcement pursuant to a court order and/or subpoena.

c. to funeral directors, coroners or medical examiners to identify a deceased person or to determine the cause of death.

d. All of the choices are correct.