NRPM: Standards for Privacy of Individually Identifiable Health Information. 7. Revocation of an authorization by the individual.


We are proposing that an individual be permitted to revoke an authorization at any time except to the extent that action has been taken in reliance on the authorization. See proposed § 164.508(e). That is, an individual could change her or his mind about an authorization and cancel it, except that she or he could not thereby prevent the use or disclosure of information if the recipient has already acted in reliance on the authorization. For example, an individual might cancel her or his authorization to receive future advertisements, but the entity may be unable to prevent mailing of the advertisements that the covered entity or third party has already prepared but not yet mailed.

An individual would revoke the old authorization and sign a new authorization when she or he wishes to change any of the information in the original authorization. Upon receipt of the revocation, the covered entity would need to stop processing the information for use or disclosure to the greatest extent practicable.