Which of the following statements about protected health information are correct?

A. The Privacy Rule protects all "individually identifiable health information" held or transmitted by a covered entity or its business associate, in any form or media, whether electronic, paper, or oral.
B. "Individually identifiable health information" is information, including demographic data, that relates to: — the individual's past, present or future physical or mental health or condition, — the provision of health care to the individual, or — the past, present, or future payment for the provision of health care to the individual, and that identifies the individual or for which there is a reasonable basis to believe it can be used to identify the individual.
C. The Privacy Rule excludes from protected health information employment records that a covered entity maintains in its capacity as an employer and education and certain other records subject to, or defined in, the Family Educational Rights and Privacy Act, 20 U.S.§1232g.
D. There are no restrictions on the use or disclosure of de-identified health information.