Or. Rev. Stat. § 746.607 - Use and disclosure of personal information

Health insurers are permitted to use or disclose individuals’ personal information in a manner that is consistent with an authorization provided by the individual or a personal representative of the individual.  Additionally, health insurers may disclose protected health information without obtaining an authorization to another covered entity under the following circumstances:

• For the other entity’s health care operations activities
• If each entity has/had a relationship with the individual who is subject of the protected health information, the protected health information pertains to the relationship and the disclosure is for the purpose of health care operations or health care fraud and abuse detection or compliance; and
• For treatment or payment activities of the receiving provider or entity

Health insurers are permitted to charge a reasonable, cost-based fee for disclosing an individual’s personal information as long as the fee includes only the cost of:

• Copying personal information requested by an individual or an individual’s personal representative, including the cost of supplies for and labor of copying;
• Postage, when an individual or the individual’s personal representative has requested that copies of personal information or an explanation or summary of protected health information is mailed; or
• Preparing an explanation or summary of personal information if requested by an individual or the individual’s personal representative.