Page 36 - Privacy_Program

INDIVIDUAL REVOCATION OF AN AUTHORIZATION TO DISCLOSE PHI AND OTHER PRPI [DP133]
Back to Table of Contents

Scope: Enterprise
Distribution: Executive Leadership Team; Director of Information Technology, Privacy and Data Security; Directors, Managers and
Supervisors; All Services and Programs Employees; and Other Employees with Access to Protected Health Information and Other
Privacy‐Restricted Participant Information (includes Contractors, temporary employees and Interns)
Purpose: To define how participants can revoke their authorizations. “Revocation of an authorization to disclose” means that a
participant may request, in writing, that the organization no longer use or disclose their privacy‐restricted information.
External Regulation or Standard: 45 C.F.R. §164.508(b)(5) ‐ Revocation of authorizations

Who is Responsible Statement Policy, Standard, or Procedure Statement
Number
Employees with Access DP133.1 The organization will allow a participant to revoke an authorization to use or
to Protected Health disclose their Protected Health Information (PHI) and other Privacy Restricted
Information (PHI) and Participant Information (PRPI), except in situations where:
Other Privacy‐
Restricted Participant
Information (PRPI)

DP133.1a (a) The organization has already acted on the authorization;
DP133.1b (b) the authorization was obtained as a condition of obtaining insurance
coverage and other laws provide the insurer with the right to contest a claim
under the policy or the policy itself.
DP133.2 The organization will take all necessary steps to honor and comply with an
Employees and others
individual revocation of an authorization to use or disclose PHI or other PRPI,
with Access to PHI and
unless stated otherwise in this policy.
Other PRPI
Employees and others DP133.3 The organization will not impose a time restriction on when an individual may
with Access to PHI and revoke authorization to use or disclose their PHI or other PRPI.
Other PRPI
Employees with Access DP133.4 The organization will require individuals to request the revocation of
to PHI and Other PRPI authorization to use or disclose their PHI or other PRPI in writing.

GES CONFIDENTIAL 30