The HIPAA privacy regulations require providers to obtain a signed consent form in order to use PHI for activities related to treatment, payment, and health care operations and to obtain a separate authorization to use or disclose PHI for any other purposes, such as marketing.