Which document must a patient sign before a medical assistant can share their health information with a third-party insurance company for billing purposes?