What are the 3 core health activities where a covered entity could disclose a patient’s PHI?

Answer: The core health care activities of “Treatment,” “Payment,” and “Health Care Operations” are defined in the Privacy Rule at 45 CFR 164.501.