HIPAA Requires the Patient to Consent to the Use and Disclosure

HIPAA requires the patient to consent to the use and disclosure of health information for treatment, payment, or health care operations (TPO) .Which statement associated with the TPO regulation is true?

A) Covered entities are mandated by HIPAA to obtain patient consent prior to starting any patient care or treatment.
B) Patients can consent to the use of their information, but they are not permitted to reject the use of their information.
C) Third-party payers cannot require that enrollment in a health plan is contingent upon obtaining the patient's consent.
D) Upon patient request, covered entities must provide a list of all disclosures of the patient's information.