Covered entities are permitted to use or disclose PHI in which of the following ways?
a. For marketing purposes without patient consent.
b. To any third-party organization for research purposes.
c. Only for treatment, payment, or healthcare operations.
d. For any purpose deemed necessary by the covered entity.