by giving the person the right to limit who may have access to it, and written authorization to use the person's protected health information must be obtained from that person. Protected health ...