Protected health information is used only for treatment, payment, and healthcare operations in accordance with applicable federal and state privacy laws including HIPAA.