What do I need to know about a subject’s ability to revoke an authorization to use his or her protected health information?
A subject always has the right to revoke consent to participate in the research. The Privacy Rule requires that a subject have the ability to revoke a previously signed authorization for researchers to use or disclose his or her protected, identifiable information for research. Researchers must honor this request, except to the extent they have already “relied on” the permission. As an example, if researchers have already included a person’s protected information in the analysis of the data, the analysis can be maintained. In addition, researchers may “continue using and disclosing protected health information that was obtained prior to the time the subject revoked his or her authorization, as necessary to maintain the integrity of the research study.” However, researchers may not use or disclose additional information that they have not yet accessed at the time the authorization is being withdrawn, except for purposes such as accounting for the subject’s withdrawal, reporting adverse
Related Questions
- May a valid authorization list categories of persons who may use or disclose protected health information, without naming specific individuals or entities?
- Does HIPAA allow CIGNA HealthCare to use protected health information (PHI) without my express authorization?
- When is authorization to disclose protected health information (PHI) not required for research?
