In which of the following circumstances must an individual be given the opportunity to agree or object to the use and disclosure of their phi? a. before their information is included in a facility directory. b. prior to disclosure to a business associate. c. before phi directly relevant to a person's involvement with the individual's care or payment of health care is shared with that person. d. both a and c.

The Health Insurance Portability and Accountability Act of 1996 aka HIPAA facilitates the safeguarding and privacy of individuals medical information with a national set of standards to save, maintain and/or handle PHI (individuals' protected health information); it's sensitive info comprising an individual's past, present or future healthcare and health status.

Due to the seriousness and criticalness of PHI, individuals are allowed to agree or object the use, disclosure or sharing of such files with certain healthcare facilities and information storage systems.

Thereby the most suitable answer would be (D.): Both A and C.