Even though HIPAA Privacy Rule does not mandate it, Covered Entities may prefer to get a patient’s consent before doing something like delivering treatment. A Covered Entity, on the other hand, must get a patient’s permission via a HIPAA Release Form prior to sharing private information for any reason other than an authorized purpose.