Prior written consent to health care providers will be the new starting point before any health care provider can use or disclose protected health information to carry out treatment, payment or health care operations. Information that does not identify the individual is not covered. Consent can be revoked, and exceptions exist, including use or disclosure for medical emergencies, treatment of inmates, public health crisis or disease control. Any health care provider – such as a physician – can, under the rule, condition treatment on obtaining an initial consent or restoring a revoked consent. All patients must be advised that they may review the covered entities’ privacy policy. The consent requirement was added to the final rule after initial comments were filed with HHS. It has drawn criticism for the cost and the complexity of compliance, as well as delaying patient treatment.