which of the following statements about the directory of patients maintained by a covered entity is true?
a. individuals must be fiven an opportunity to deny permission to place information about them in the directory
b. individuals must provide a written authorization before information about them can be placed in the directory
d. the directory may contain diagnostic information as long as it is confidential