Individual Rights

• An individual may revoke consent in writing, except to the extent that the covered entity has taken action in reliance on the consent.
• An individual may request restrictions on uses or disclosures of health information for TPO. The covered entity need not agree to the restriction requested, but is bound by any restriction to which it agrees.
• An individual must be given a notice of the covered entity's privacy practices and may review that notice prior to signing a consent.