1. (a) A valid authorization is required to disclose protected health information (PHI) unless it is:

   1. (1) for the purposes of treatment, payment, or health care operations; or
   2. (2) listed in Oklahoma Administrative Code (OAC) 340:2-8-6.

2. (b) An authorization is considered valid, when:

   1. (1) it contains the elements described, per Section 164.508(c) of Title 45 of the Code of Federal Regulations and OAC 340:2-8-2;
   2. (2) the expiration date has not passed; and
   3. (3) the authorization is signed by the client, parent, guardian, or client's personal representative.
3. (c) A client may only revoke an authorization in writing.

Added at 20 Ok Reg 2907, eff 8-21-03 (emergency)

Added at 21 Ok Reg 784, eff 4-26-04

Amended at 36 Ok Reg 1777, eff 9-16-19