Comment: In general, commenters did not distinguish between "consent" and "authorization". Commenters used both terms to refer to the individual's giving permission for the use and disclosure of protected health information by any entity.
Response: In the final rule we have made an important distinction between consent and authorization. Under the final rule, we refer to the process by which a covered entity seeks agreement from an individual regarding how it will use and disclose the individual's protected health information for treatment, payment, and health care operations as "consent." The provisions in the final rule relating to consent are largely contained in § 164.506. The process by which a covered entity seeks agreement from an individual to use or disclose protected health information for other purposes, or to authorize another covered entity to disclose protected health information to the requesting covered entity, are termed "authorizations" and the provisions relating to them are found in § 164.508.