How do patients authorize a new care provider to access their data? How do patients prevent the government from accessing their private health data? (Obviousl

How do patients authorize a new care provider to access their data? How do patients prevent the government from accessing their private health data? (Obviously the latter is a problem even for distributed systems, but a lot easier if the government already has the data on servers they control!)