A patient may revoke in writing a disclosure authorization to a health care provider at any time unless disclosure is required to effectuate payments for health care that has been provided or other substantial action has been taken in reliance on the authorization. A patient may not maintain an action against the health care provider for disclosures made in good-faith reliance on an authorization if the health care provider had no actual notice of the revocation of the authorization.