There are some regrettable examples of cells and tissue being taken from patient specimens without their knowledge, some of which give birth to entire fields of research, and then it is later unclear whether data that could re-identify the patient's family (like genomic data) can be published [1]. It can be really hard to fully de-identify imaging and molecular data.
[1]: http://www.nature.com/news/deal-done-over-hela-cell-line-1.1...
You don't need to get consent if the PHI is de-indentified and the data was obtained through a regular course of treatment (not a study). This is really important because hospitals can publish anonymized case reviews for rare disorders or perform chart reviews on patient outcomes (drug X produced Y outcome in Z patients with [some condition]). I read through a lot of these papers on a daily basis and can't imagine the state of medical literature if consent was needed for publishing this clinical data. Retrospective chart reviews are typically exempt from human subject regulations.
More info: http://wichita.kumc.edu/Documents/wichita/researchcompliance...
The cases of unauthorized cell lineages predate HIPAA and other health laws that would make such actions illegal today.
However, patients not owning their own health data makes no sense. What data could belong more to a person than their own health data?