Revocation of HIPAA Authorization under HIPAA Rule 164.508

Under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the Privacy Regulations written pursuant to the Act, the general rule is that covered entities may not use or disclose an individual's protected health information for purposes unrelated to treatment, payment, healthcare operations, or certain defined exceptions without first obtaining the individual's prior written authorization. An individual may revoke an authorization at any time, provided that the revocation is in writing, unless the health care provider has already provided personal health information based on the patients authorization. The health care provider should stop providing information based on a patients authorization as soon as possible.