In the Privacy Rule, there are separate standards relating to patient authorization and patient consent. Patient authorization is required for any use or disclosure of PHI not required or permitted by the Privacy Rule, whereas patient consent is permitted for a limited number of uses and disclosures – i.e., inclusion in a hospital directory. Generally, patient authorizations are formal and must be documented, while patient consent can be verbal.