Health care operations are broadly defined as activities of covered entities that involve maintaining and monitoring the institution. They can include conducting quality assessment and improvement activities; developing clinical guidelines; case management; reviewing the competence or qualifications of health care professionals; professional education and training; fraud and abuse programs; business planning and management; and customer service. This catch-all is an exception to the HIPAA consent requirements on the use and disclosure of PHI and requires no specific authorization.