To follow HIPAA privacy standards, be sure to get the patient's approval to involve another person in the discussion of his or her private health information. Which of the following statements is true regarding permission?

A) Asking the patient's communication preferences will suffice for permission granted.
B) The patient's daughter tells you she is authorized to receive PHI regarding her mother.
C) The provider asks you to contact the patient's daughter to discuss a procedure her mother should have.
D) Document the permission; without documentation, it is considered "not permitted."

D