Authorization to Release PHI

[Chaz]

Is an authorization to release protected health information that has been executed by a participant/patient itself protected health information that is subject to the privacy rules?

[GBurns]

I cannot give you a cite, but the authorization itself give personally identifiable information about the health activities of the participant and therefore should be protected. It could tell what sort of medical practitioner or specialist is being seen etc.

[Peter Gulia]

Could the authority granted include authority to release information about the authority granted?