This guide is silent on the relationship between a covered entity and the CP.  It may be a Business Assoicate (BA) or not.  If it is a BA then we provide an example of the covered entity exchanging a consent resource indicating that the patient has provided consent for the CP (BA) to release their information to a non-covered entity.  If the CP is not a BA, then the consent to release information should be obtained by the covered entity and held in their records.  The release of information to the CP should only be done if the patient has consented.  If the CP is a BA and does not receive the patient's consent to disclose, then the CP should not share the information with an entity that is not a covered entity or under a BA relationship. Informing the patient depends on the workflow of the covered entity the CP and the patient.  We are not requiring a specific method of informing the patient.   Add this description to the IG and provide cross reference between the flow diagrams and the use case descriptions.