14.15 Revocation of an Authorization
14.15.1 POLICY STATEMENT
Individuals have the right to revoke the authorization to access, release, use or disclose their protected health information (PHI) at any time. ( Also see: Authorization for Use or Disclosure of PHI.)
14.15.2 POLICY INTERPRETATION AND IMPLEMENTATION
| Revocation Request | All requests for revocation of an individual’s authorization to access, release, use, or disclose PHI must be submitted to the HIPAA Privacy Officer in writing. The revocation must be specific enough to permit identification of the authorization that is being revoked. The Health Plan may develop a form for this purpose. Oral requests will not be honored. |
| Notification of Personnel of a Revocation | Upon receipt of a written revocation, the HIPAA Privacy Officer will notify personnel (including impacted business associates) that a revocation has been received and that no further information may be released as specified in the authorization, with the exception that personnel may, as a result of relying on the authorization: |
| Exceptions to Revocation | Complete the task it started (e.g., billings for services already provided); or,Submit findings from an independent medical examiner to the person/entity requesting it. |
| Record Retention | A copy of all HIPAA covered information and any revisions shall be maintained for a period of at least six (6) years. Such retention may be in printed or electronic format, or both. |
| Privacy Officer | The Privacy Officer is responsible for the development and implementation of the HIPAA policies and procedures. The Privacy Officer is also the contact person for any questions or complaints regarding HIPAA. Questions or concerns about HIPAA rights should be directed to the Privacy Officer during regular business office hours Monday through Friday, except holidays, at (651) 696-6280. |
| Violations | Violations of this policy will be subject to discipline. |