Which type of consent is required for collecting, using, and disclosing a client's personal health information?