The terms “Consent” and “Authorization” have often caused confusion and debate. Are they the same thing or do they have different purposes? The Privacy Final Rule did little to ease the confusion. Published in the December 28, 2000, Federal Register the final rule required a provider with a direct treatment relationship to obtain an individual’s written consent prior to using or disclosing PHI for treatment, payment, or health care operations (TPO). The final modifications to the Privacy Rule, published in the Federal Register August 14, 2002, (also found at the same link) removed the consent requirement and made the consent discretionary by the covered entity.