True/False & Explanatory: Each healthcare agency and provider must have policies and procedures for maintaining the privacy of Protected Health Information (PHI). Under the HIPAA privacy rule, it is illegal to: Healthcare agencies must have policies that provide guidelines for: Patients have a right to: Health care operations are defined as activities considered in support of treatment and payment for which protected health information could … used or disclosed without individual authorization...