 3. Have the ability to understand and provide written authorization for the use and disclosure of personal health information PHI per Health Insurance Portability and Accountability Act HIPAA privacy ruling in the US or applicable regulations outside the US. 