The letter stated that the underwriter is not required to get a signed consent from the student, quoting the HIPAA statement, "A covered health care provider may, without consent, use or disclose ...