Consent is not required as HIPAA permits disclosure as long as Leland Medical Clinic and DHA-affiliated researchers will be sharing patient data with only those health care professionals that also have a relationship with the individual who is the subject of the PHI. Further, the MS Medicaid Notice of Privacy Practices and the application form for Medicaid and CHIP authorize providers to share information with each other. Thus, the DHA can use an "opt out" approach to consent. HIPAA section 164.5220 allows us to share data unless the Medicaid beneficiary asks and the clinic agrees to stop sharing information.