SECTION 340:2-8-7. Authorization

(a)   A valid authorization is required to disclose protected health information (PHI) unless it is:

(1)   for the purposes of treatment, payment, or health care operations; or

(2)   listed in Oklahoma Administrative Code (OAC) 340:2-8-6.

(b)   An authorization is considered valid, when:

(1)   it contains the elements described, per Section 164.508(c) of Title 45 of the Code of Federal Regulations and OAC 340:2-8-2;

(2)   the expiration date has not passed; and

(3)   the authorization is signed by the client, parent, guardian, or client's personal representative.

(c)   A client may only revoke an authorization in writing.

[Source: Added at 20 Ok Reg 2907, eff 8-21-03 (emergency); Added at 21 Ok Reg 784, eff 4-26-04; Amended at 36 Ok Reg 1777, eff 9-16-19]