Finally, A Reasonable Approach: Or at least that's what it seems at first blush. The Center for Democracy and Technology has issued a paper that proposes a new framework for thinking about patient consent and medical record privacy. I've only glanced over it, but they seem to have hit the nail on the head: the system should assume consent for normal/usual/proper uses, so the delivery, performance, and payment for healthcare isn't impeded, but should require meaningful consent for other purposes.
Of course, in my opinion that's what the HIPAA regulation-drafters were shooting for, in a less-than-explicit way.