Although not a requirement of the HIPAA Privacy Rule, Covered Entities may wish to obtain a patient´s consent before - for example - providing treatment. By contrast, a Covered Entity has to obtain a patient´s authorization via a HIPAA Release Form before disclosing personal identifiable information other than for a permitted use.