3. Has the ability to understand and provide written authorization for the use and disclosure of personal health information (PHI) [per Health Insurance Portability and Accountability Act (HIPAA) privacy ruling in the US].