Q&A: Revoking authorization for disclosure

Q: If an individual provides authorization for a disclosure, can the individual later revoke the authorization? Is the covered entity (CE) then required to “take back” or demand the erasure of any documentation by third parties that may have been made following the original authorization?

A: Individuals have the right to revoke their authorizations in writing at any time. However, the revocation is not effective if the CE has already released the protected health information (PHI) based on the authorization the individual signed previously. You are not required to “take back” or demand erasure of information released before the authorization was revoked.

Editor’s note: Mary Brandt, MBA, RHIA, CHE, CHPS is a healthcare consultant specializing in healthcare regulatory compliance and operations improvement. She is also an advisory board member for BOH. This information does not constitute legal advice. Consult legal counsel for answers to specific privacy and security questions. Opinions expressed are those of the author and do not represent HCPro or ACDIS