Can a patient revoke an authorization at any time?

Yes. Under HIPAA a patient may revoke an authorization at any time, except to the extent the covered entity has already acted in reliance on the authorization; document the revocation and the date received.

Is an electronic signature valid on a revocation?

Yes. Electronic signatures are valid when they meet the ESIGN Act and applicable state UETA/ESRA requirements and when the organization captures an audit trail and consent to electronic records.

Does revocation apply retroactively to past disclosures?

No. Revocation generally applies to future disclosures; disclosures made in good-faith reliance before receipt of the revocation are not undone by the revocation.

What if the revocation is unsigned or incomplete?

Unsigned or incomplete revocations may be treated as invalid. Request completion, verify identity, and document communications to show good-faith attempts to process the request.

Should business associates be notified?

Yes. Notify any business associates or third parties who received PHI under the original authorization when appropriate, and document those notifications in the record.

How long must revocations be retained?

Retain executed revocations in accordance with HIPAA (six years from creation or last effective date) and applicable state rules; maintain audit trails to show receipt and processing.

Electronic Signature
Templates
Other
Revocation of HIPAA Authorization

Revocation of HIPAA Authorization

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

What a Revocation of HIPAA Authorization Is and When It Applies

The Revocation of HIPAA Authorization is a written statement by a patient or their authorized representative that withdraws a previously granted authorization for the use or disclosure of protected health information (PHI). Under the HIPAA Privacy Rule, a patient may revoke an authorization at any time except to the extent that covered entities have already acted in reliance on it (45 CFR §164.508(b)(5)). Revocations should be clear, dated, and signed; they specify which prior authorization is being revoked and the scope and effective date of the revocation.

Why a Clear Revocation Matters for Privacy and Compliance

Revoking a HIPAA authorization restores patient control over future disclosures of PHI, limits ongoing data sharing, and reduces exposure of sensitive records. Timely revocations help covered entities update access controls and ensure disclosures occur only under lawful exceptions or prior reliance.

Who typically completes and processes a revocation

This form is used by patients or their authorized representatives to stop future disclosures of protected health information.

Patients or legal guardians who previously signed an authorization for PHI disclosure.
Healthcare providers and privacy officers who process revocation requests and update access permissions.
Insurers, billing agents, and third parties notified under the original authorization.

Core elements to include in a professional revocation

A professional Revocation of HIPAA Authorization is concise, identifies the original authorization, states the revocation scope and date, and includes a clear signature and contact details.

Document Title

Use an explicit title such as 'Revocation of HIPAA Authorization' and include a revision or effective date to clearly link the revocation to prior authorizations.

Patient ID

Provide the patient's full legal name, date of birth, and any patient identification number used by the health system; mismatches can delay processing or trigger verification.

Original Authorization

Reference the original authorization by date, recipient(s), and description of PHI disclosed so the covered entity can identify which consent is being withdrawn without ambiguity.

Scope & Date

Clearly state whether the revocation applies to all disclosures or specific recipients, list the affected recipients, and provide the effective revocation date in MM/DD/YYYY format.

Signature

Include signature of the patient or authorized representative, printed name, relationship to patient, and date. Electronic signatures are valid if executed under ESIGN/UETA and recorded.

Contact Details

Provide a daytime phone number, email, and mailing address so the provider can confirm receipt, request clarification, or follow up about prior disclosures.

Security and compliance points at a glance

PHI Covered: Individually identifiable health information.

Revocation Date: Effective date stops future disclosures.

Signature Requirement: Patient or authorized rep must sign.

Audit Trail: Document receipt and processing recorded.

BAA Needed: Business associate agreement required with vendors.

Storage: Secure retention per HIPAA rules.

Key legal and operational risks of an incorrect revocation

Noncompliance Penalty: Civil and criminal liability.

Operational Risk: Continued disclosures despite revocation.

Incorrect Form: Processing delays; possible legal challenge.

Missing Signature: Revocation may be invalid.

Improper Scope: Too broad or too narrow.

Recordkeeping Failure: Retention violations (45 CFR §164.530(j)).

Common mistakes to avoid when preparing a revocation

Failing to reference the original authorization's date or recipient often prevents a covered entity from identifying which consent to withdraw, causing processing delays and additional requests for clarification.
Using incomplete patient identifiers (initials, nickname, or absent DOB) leads to rejections or identity verification steps that slow implementation.
Not providing a dated signature or relying on unsigned email statements can render the revocation unenforceable under HIPAA requirements.
Failing to notify all previously authorized recipients or to document notification leaves risk of continued improper disclosures and compliance gaps.

Step-by-step: complete and submit a revocation

Follow these steps to complete and deliver a Revocation of HIPAA Authorization for timely processing by covered entities.

01

Locate original: Identify original authorization date and recipient.
02

Complete form: Enter full patient details and revocation scope.
03

Sign and date: Patient or representative must sign and date.
04

Submit: Send to provider privacy office and keep proof.

How the revocation is routed and processed

Overview of routing after signing: who receives the revocation and how covered entities record and act on it.

Send to provider: Deliver to health care provider privacy office.
Notify BAAs: Inform business associates that received PHI.
Confirm receipt: Request written acknowledgment of revocation.
Update systems: Provider updates access logs and disclosures.

Configuring an online workflow for revocation handling

Configure an online workflow to capture revocation details, authenticate signers, and route notifications to privacy and compliance teams.

Field	Configuration
Authentication	Use email link plus optional SMS code for verification.
Signature Type	Enable ESIGN-compliant electronic signature capture.
Routing	Auto-notify privacy officer and BAA contacts.
Retention	Archive signed revocations in secure storage for HIPAA retention.

Where state rules commonly diverge for revocations

Key jurisdictional differences when completing or enforcing a revocation; table highlights common requirements and where state rules diverge.

Requirement	Standard Rule	Notable Variation
Notarization		varies by state
Witnesses		varies (some forms)
Formality	written	written required
Electronic Validity		yes (esign/ueta)

eSignature vendor comparison for processing revocations

Pricing and capability comparison for common eSignature vendors. signNow appears first as the baseline for cost and compliance features.

	signNow	DocuSign	Adobe Sign	PandaDoc	HelloSign
Starting Price	$8/user/mo	$15/user/mo	$14/user/mo	$19/user/mo	$15/user/mo
Free Trial	7-day free trial	Varies by plan	Varies by plan	Varies by plan	Varies by plan
Bulk Send	Yes	Yes	Yes	Yes	Varies
Audit Trail	Yes	Yes	Yes	Yes	Yes
HIPAA Compliant	Yes	Yes	Yes	No	No

Real-world examples of electronic revocation workflows

Two customer examples illustrate how organizations process revocations and maintain compliance using eSignature-enabled workflows.

Fertility Centers of Illinois

The clinic standardized revocations into its intake workflows to stop future disclosures quickly and securely.

Signatures and audit trails ensured reliable attribution and processing.
John Butler, Founder, noted the platform's strong compliance posture and responsive support that helped the clinic manage patient authorizations and follow-up.

Martin Properties

A small healthcare-adjacent provider used online revocation forms to centralize requests and reduce phone inquiries.

Electronic records made it easier to trace receipt and action.
Tim Martin, Founder, reported the ability to process and execute documents online with compliance and security for both mobile and offline use.

Practical tips to ensure valid and efficient revocations

Adopt consistent procedures to verify identity, record receipt, and update disclosure lists when processing revocations.

Verify patient identity using two methods

Confirm identity with government-issued ID plus matching medical record data; log verification in the revocation record to reduce the risk of wrongful denial or privacy breaches.

Record and acknowledge receipt promptly

Provide a dated acknowledgment to the patient or representative and retain copies; an audit trail reduces disputes about whether or when the revocation was received.

Communicate with downstream recipients

Notify known prior recipients and business associates in writing when appropriate; document notifications to limit continued disclosures and preserve compliance evidence.

Use electronic workflows with BAAs

Employ eSignature platforms that support BAAs, detailed audit trails, and secure storage to accelerate processing while meeting HIPAA safeguards.

Important timing considerations for revocation effectiveness and processing

Timing rules affect when a revocation takes effect and how previously disclosed information is treated; recognize both immediate and exception-based timings.

Effective Date:

Use MM/DD/YYYY; affects future disclosures only.

Prior Reliance Exception:

Does not undo disclosures already made in reliance before receipt.

Acknowledgment Timeline:

Request written receipt from provider within a reasonable time.

Provider Action:

Update access lists and notify BAAs promptly.

Audit Retention:

Keep records per HIPAA retention rules.

Key processing milestones after submission

A simple milestone view for administrators tracking the revocation from submission to record update.

01

Submission

Patient signs and sends revocation to the provider.

02

Acknowledgment

Provider confirms receipt and logs the revocation.

03

Notification

Provider notifies business associates and prior recipients where applicable.

04

System Update

Access controls and disclosure logs are adjusted to reflect the revocation.

Technical considerations for eSigning and eSubmission

Ensure the platform supports HIPAA safeguards, BAAs, and reliable audit trails before using it to accept revocations electronically.

Authentication: Email + SMS codes
Audit Trail: IP, timestamp, action log
Storage Formats: PDF, PDF/A, DOCX

Frequently asked questions about Revocation of HIPAA Authorization

Answers to common questions about validity, timing, and electronic processing of revocations to help providers and patients handle typical issues.

Need help? Contact support

Can a patient revoke an authorization at any time?
Yes. Under HIPAA a patient may revoke an authorization at any time, except to the extent the covered entity has already acted in reliance on the authorization; document the revocation and the date received.
Is an electronic signature valid on a revocation?
Yes. Electronic signatures are valid when they meet the ESIGN Act and applicable state UETA/ESRA requirements and when the organization captures an audit trail and consent to electronic records.
Does revocation apply retroactively to past disclosures?
No. Revocation generally applies to future disclosures; disclosures made in good-faith reliance before receipt of the revocation are not undone by the revocation.
What if the revocation is unsigned or incomplete?
Unsigned or incomplete revocations may be treated as invalid. Request completion, verify identity, and document communications to show good-faith attempts to process the request.
Should business associates be notified?
Yes. Notify any business associates or third parties who received PHI under the original authorization when appropriate, and document those notifications in the record.
How long must revocations be retained?
Retain executed revocations in accordance with HIPAA (six years from creation or last effective date) and applicable state rules; maintain audit trails to show receipt and processing.

Explore Templates

Deed of Trust Assignment Agreement of Lease Dated April 20, 2012 Residential Lease Extension Agreement Operative Lease Agreement Bill of Costs - District of Idaho Court Appointment of Attorneys in Civil Cases

be ready to get more

Join over 28 million airSlate SignNow users

Sign Now