Or. Rev. Stat. § 192.558 - Health care provider and state health plan authority

A health care provider or state health plan can use or disclose protected health information if authorized by the patient or the patient’s representative.  A provider or plan may use or disclose protected health information without obtaining an authorization for the following purposes:

• The information is for use in the provider or plan’s own treatment, payment, or health care operations;
• The disclosure is to another covered entity that has/ had a relationship with the patient, for purposes of the entity’s health care operations or fraud and abuse detection or compliance;
• The disclosure is to any covered entity or provider for treatment or payment activities of the receiving entity;
• The disclosure is otherwise authorized by law.