Patients must give their consent for healthcare providers or insurance companies to collect, use, or disclose their PHI. There are different types of consent (e.g., implied, express, informed), and different rules apply depending on the circumstance.