Skip to Main Content Skip to Footer Toggle Navigation Menu

14.15 Revocation of an Authorization


Individuals have the right to revoke the authorization to access, release, use or disclose their protected health information (PHI) at any time. ( Also see: Authorization for Use or Disclosure of PHI.)


Revocation RequestAll requests for revocation of an individual’s authorization to access, release, use, or disclose PHI must be submitted to the HIPAA Privacy Officer in writing. The revocation must be specific enough to permit identification of the authorization that is being revoked. The Health Plan may develop a form for this purpose. Oral requests will not be honored.
Notification of Personnel of a RevocationUpon receipt of a written revocation, the HIPAA Privacy Officer will notify personnel (including impacted business associates) that a revocation has been received and that no further information may be released as specified in the authorization, with the exception that personnel may, as a result of relying on the authorization:
Exceptions to RevocationComplete the task it started (e.g., billings for services already provided); or,Submit findings from an independent medical examiner to the person/entity requesting it.
Record RetentionA copy of all HIPAA covered information and any revisions shall be maintained for a period of at least six (6) years. Such retention may be in printed or electronic format, or both.
Privacy OfficerThe Privacy Officer is responsible for the development and implementation of the HIPAA policies and procedures. The Privacy Officer is also the contact person for any questions or complaints regarding HIPAA. Questions or concerns about HIPAA rights should be directed to the Privacy Officer during regular business office hours Monday through Friday, except holidays, at (651) 696-6280.
ViolationsViolations of this policy will be subject to discipline.