. "how the entity uses and discloses PHI, and how individuals may exercise their rights with respect to their PHI. For most uses and disclosures of PHI other than for treatment, payment, healthcare operations or certain public policy purposes, HIPAA generally requires that covered entities obtain a valid written individual authorization." . . .