How to Revoke Authorization to Disclose Health Information

To revoke authorization to disclose health information, send a signed written notice to the healthcare provider or organization that holds the authorization. The revocation takes effect as soon as that entity receives your letter.¹ A phone call is not enough. You need a dated paper record or a documented electronic submission.

You do not have to give a reason, and a provider generally cannot refuse to treat you, bill you, or enroll you in a plan because you withdrew an authorization.²

First, Check Whether the Authorization Already Expired

Before writing anything, pull out the form you originally signed. Every valid HIPAA authorization has to include either an expiration date or an expiration event, such as “upon completion of the insurance application.”² If that date has passed or the triggering event has happened, the authorization is already dead and the provider should not be disclosing anything under it. You do not need to revoke a form that has expired on its own.

Research authorizations are the exception. They can use open-ended language like “end of the research study” or even “none” as their expiration term, so a written revocation is the only way to stop future disclosures under those.

What to Put in the Revocation Letter

HIPAA does not prescribe a specific form. If the provider has its own revocation form, using it is usually the fastest route, so call the medical records department and ask. If you are writing your own letter, include:

Your full name and date of birth, so you are not confused with another patient.
A clear statement of intent. Something like “I revoke my authorization to disclose my health information” is enough. Do not soften it or bury it inside other requests.
Enough detail to identify the original authorization. Reference the date you signed it and its purpose. For example: “the authorization I signed on March 15, 2025, permitting disclosure of my records to ABC Insurance Company.”
The name of the person or organization that was authorized to receive the information, so the provider knows which downstream recipient to cut off.
Your signature and the current date. Unsigned letters get returned or ignored.

Notarization is not required. HIPAA lets providers verify identity flexibly and accepts scanned or valid electronic signatures.³

Where to Send It

Send the letter to the healthcare provider or organization that originally issued the authorization, not to the third party that was receiving your information. Sending it to the wrong place does nothing, because the revocation only becomes binding when the entity holding the authorization actually receives it.¹

Certified mail with return receipt is the safest option. The return receipt gives you a signed confirmation of exactly when the provider received your letter, which is the fact you will need if any disclosure happens after that date. Keep a copy of the letter along with the mailing receipt.

Submitting Through a Patient Portal

Many providers now accept revocations electronically through secure patient portals, and HHS guidance recognizes that covered entities may accept electronically signed requests submitted this way.⁴ Save a screenshot or confirmation email as your proof. If you are not sure whether the portal accepts revocations specifically, call the medical records department before assuming a portal message counts.

When the Revocation Takes Effect

The revocation becomes effective the moment the covered entity receives your written notice.¹ There is no statutory grace period. Internal systems may need a short window to update in practice, but the legal compliance date is the date of receipt. Any disclosure made after that date, where the provider was not already acting in reliance on the original authorization, would be a violation.

Do not expect an automatic acknowledgment. HIPAA does not require providers to send a confirmation letter, though many do. If a week goes by with no response after certified mail, your return receipt is your proof. If you sent it through a portal and have heard nothing, follow up with medical records to confirm the revocation is in their system.

What Revocation Cannot Undo

A revocation only works going forward. It cannot pull back disclosures the provider already made while the authorization was active. Federal regulation protects providers who acted “in reliance” on your valid consent before receiving your cancellation.² If your doctor already sent records to an insurer that then denied your application, revoking will not force the insurer to return the records or reconsider the decision.

There is also a narrow insurance carve-out. If the authorization was a condition of getting coverage, other law may still let the insurer use the information to contest a claim or the policy itself after you revoke.²

Special Categories That Need Separate Handling

Psychotherapy Notes

HIPAA treats psychotherapy notes separately from the rest of your record. A provider needs a standalone authorization to disclose them, and it cannot be bundled with a general records release.² Because it is a separate authorization, revoking a general authorization does not automatically revoke it. If you signed both, revoke both, either by naming each one in your letter or by writing two letters.

Research Studies

Revoking a research authorization stops any new data collection about you. Researchers can keep using information they already gathered before your revocation to the extent needed for the integrity of the study, including accounting for your withdrawal, reporting adverse events, investigating scientific misconduct, and including previously collected data in an FDA submission.⁵ What they cannot do is pull additional records about you after the revocation date.

Substance Use Disorder Records

Records tied to substance use disorder treatment are also governed by 42 CFR Part 2, which is stricter than HIPAA in places. The consent form must include your right to revoke in writing, and once revoked, no further disclosures can be made under that consent, though the program is not liable for disclosures made before it learned of the revocation.⁶ One caveat: if you were referred for treatment through the criminal justice system, the consent form sets a date or event when it becomes revocable, and you cannot revoke before that trigger.

Revoking on Behalf of a Minor or Deceased Person

HIPAA lets a “personal representative” exercise privacy rights on behalf of the patient, including revoking authorizations.

For an unemancipated minor, a parent is usually the personal representative. Two exceptions matter. If state law lets the minor consent to a particular kind of care on their own (often reproductive health, mental health, or substance use treatment), the minor controls the authorization for those records. A provider can also decline to recognize a parent as personal representative if it reasonably believes the minor has been or may be abused or neglected by that parent.⁷

For a deceased patient, the executor or administrator of the estate, or another person with legal authority under state law, acts as the personal representative and can revoke authorizations covering the decedent’s records, but only for records relevant to their responsibilities.⁸

If the Provider Ignores Your Revocation

If disclosures continue after the provider received your written revocation, you can file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights. Complaints go through the OCR Complaint Portal or by mail, fax, or email, and you will need to name the entity, describe what happened, and sign the complaint.⁹

The deadline is 180 days from when you knew or should have known about the violation, and OCR can waive it for good cause.¹⁰ This is where your delivery proof pays off. A certified mail receipt or portal confirmation showing the provider received your revocation on a specific date makes it straightforward to show that any later disclosure was unauthorized.