A covered entity may use or disclose PHI without authorization, or documentation of a waiver or an alteration of authorization, for all of the following EXCEPT:
a. Limited data set with an approved data use agreement.
b. Data that does not cross state lines when disclosed by the covered entity.
c. Use of decedents’ information, with certain representations by the researcher.
d. Activities preparatory to research, with certain representations by the researcher.