In which of the following circumstances must an individual be given the opportunity to agree or object to the use and disclosure of their PHI?
A. Before their information is included in a facility directory.
B. Prior to disclosure to a business associate.
C. Before PHI directly relevant to a person's involvement with the individual's care or payment of health care is shared with that person.
D. Both A and C.