The HIPAA Privacy Rule permits use or disclosure of a patient's PHI in accordance with an individual's authorization that: Is written and signed by the patient, Includes core elements and required statements set forth in the HIPAA Privacy Rule and DoD's implementing issuance.