1. (a) Authorization to disclose nonpublic personal health information under 3 AAC 26.680 must be in written or electronic form and must contain

   1. (1) the identity of the consumer who is the subject of the nonpublic personal health information;
   2. (2) a general description of the types of nonpublic personal health information that may be disclosed;
   3. (3) a general description of the person to whom the licensee intends to disclose nonpublic personal health information, the purpose of the disclosure, and how the recipient of the information will use the information;
   4. (4) the signature of the consumer who is the subject of the nonpublic personal health information or an individual who is legally empowered to grant authority for the consumer and the date signed; the consumer or individual who is legally empowered to grant authority for the consumer may agree to provide an electronic signature subject to AS 09.80;
   5. (5) the length of time for which the authorization is valid; and
   6. (6) a statement to the effect that the consumer may revoke the authorization at any time along with a clear and easy-to-follow description of how the consumer may revoke the authorization.
2. (b) The duration of an authorization under (a) of this section may be no more than 24 months.
3. (c) A consumer may revoke an authorization at any time but the revocation may not take effect before the date the licensee receives the revocation.
4. (d) A licensee shall retain the authorization or a copy of the authorization in the licensee's records of the consumer.
5. (e) A licensee is not required to deliver an authorization form to a consumer or to include an authorization form in any other notice unless the licensee intends to disclose nonpublic personal health information under 3 AAC 26.680.

(Eff. 1/1/2005, Register 172; am 7/25/2008, Register 187)