Revocation of HIPAA Authorization is the process of a patient or healthcare consumer ending the permission they have granted to a healthcare provider, healthcare clearinghouse, or health plan to use, share, and disclose their protected health information (PHI). It is the patient’s right under the Health Insurance Portability and Accountability Act (HIPAA) to revoke any authorization they have previously given. There are two types of Revocation of HIPAA Authorization: written and verbal. Written revocations must be made in writing and signed by the patient or their legally authorized representative. The revocation must state the patient’s name and the date of the revocation. The revocation must also specifically state the authorization that is being revoked. The healthcare provider must act on the written revocation within a reasonable period of time, usually 30 days. Verbal revocations must also be documented by the healthcare provider. The documentation must include the date, time, and content of the verbal revocation. The healthcare provider must also act on the verbal revocation within a reasonable period of time, usually 30 days. Once the healthcare provider has received the revocation, they must no longer use or disclose the patient’s PHI in accordance with the authorization that has been revoked. If the revoked authorization was for a third party, such as a research organization, the healthcare provider must also notify the third party of the revocation.
Revocation of HIPAA Authorization is the process of a patient or healthcare consumer ending the permission they have granted to a healthcare provider, healthcare clearinghouse, or health plan to use, share, and disclose their protected health information (PHI). It is the patient’s right under the Health Insurance Portability and Accountability Act (HIPAA) to revoke any authorization they have previously given. There are two types of Revocation of HIPAA Authorization: written and verbal. Written revocations must be made in writing and signed by the patient or their legally authorized representative. The revocation must state the patient’s name and the date of the revocation. The revocation must also specifically state the authorization that is being revoked. The healthcare provider must act on the written revocation within a reasonable period of time, usually 30 days. Verbal revocations must also be documented by the healthcare provider. The documentation must include the date, time, and content of the verbal revocation. The healthcare provider must also act on the verbal revocation within a reasonable period of time, usually 30 days. Once the healthcare provider has received the revocation, they must no longer use or disclose the patient’s PHI in accordance with the authorization that has been revoked. If the revoked authorization was for a third party, such as a research organization, the healthcare provider must also notify the third party of the revocation.
