Which of the following statement(s) would be permitted uses and disclosures of a patient's protected health information (PHI)?

I.A healthcare provider may disclose PHI when the disclosure of that PHI is used for its own treatment, payment, and health care operations activities

II.A healthcare provider may have disclosures of PHI that are incidental or "incident to" an otherwise permitted use or permitted disclosure, so long as the provider has adopted reasonable safeguards

III.A healthcare provider may release a patient's PHI if the patient has provided a written authorization from the patient that meets the requirements set forth in the Privacy Rule

a.I

b.II

c.I and II

d.I, II, and III