Covered Entities are allowed to release and share patient information for treatment, payment, and healthcare operations. For all other disclosures of patient information, Covered Entities must obtain patient consent or give patients the opportunity to object to their information being released or shared. How patients consent or object should be explained in the Covered Entity´s Notice of Privacy Practices along with an explanation of how patients can obtain an “Accounting of Disclosures” to ensure information is not released or shared without their consent.