An Authorization for research uses and disclosures need not have a fixed expiration date or state a specific expiration event; the form can list “none” or “the end of the research project.” However, although an Authorization for research uses and disclosure need not expire, a research subject has the right to revoke, in writing, his/her Authorization at any time. The individual’s revocation is effective, except to the extent that the covered entity has taken action in reliance upon the Authorization prior to revocation. For example, a covered entity is not required to retrieve information that it disclosed under a valid.
