use or disclose protected health information to carry out treatment, payments, or health care operations." This is incorrect. The underwriter needs to have the student sign an authorization to use and ...