Consent refers to instances in which the privacy rule does not require a covered entity/health care provider to obtain consent for uses and disclosures of protected health information, such as for treatment, payment and healthcare operations. 

Authorization is required by the Privacy Rule for uses and disclosures of protected health information (PHI) not otherwise allowed by the Rule.