Skip to Content

Privacy and Confidentiality in Oregon

        The state of Oregon’s official policy is that individual health information must be protected from unlawful use or disclosure.1  The law specifically provides the right to confidentiality of medical records and information to patients in adult foster homes,2 nursing homes,3 home health agencies,4 in-home care patients,5 and individuals receiving mental health community treatment and support services.6  Additionally, all insurers offering health benefit plans must ensure the confidentiality of patient records and information.7  While confidentiality and privacy of medical information is paramount, the law provides a number of means by which medical information may be disclosed without the authorization of the patient. 

        A health care provider or state health plan may use or disclose protected health information without obtaining an authorization for use in the provider or plan’s own treatment, payment, or health care operations, to another covered entity for purposes of the entity’s health care operations or fraud and abuse detection or compliance.8 Nursing homes may release records in conjunction with a patient transfer or where examination is required by a third party payment contractor.9  The Long Term Care Ombudsman may access any long term care facility resident’s records.10

        Disclosure of protected health information may be made by and to public health authorities under certain circumstances.  During a declared public health emergency, the public health director and local public health administrators will have immediate access to individually identifiable health information,11 and may disclose such information to authorized state, local or federal agencies, health care providers, or to determine the cause or manner of a death.12  The Oregon Health Authority or a local public health administrator may release information obtained during an investigation of a reportable disease or disease outbreak to authorized individuals, including individually identifiable information, if there is clear and convincing evidence that release is necessary to avoid an immediate danger to other individuals or to the public.13

        Disclosure may be made for research purposes, if the research meets certain criteria.  All disclosures of protected health information for research purposes are subject to state and federal law; the Department of Human Services may use or disclose an individual’s information for research without a written authorization if the Institutional Review Board waives the authorization requirement.14  The Oregon Health Authority or a health agency may publish statistical compilations and reports relating to epidemiologic or general morbidity and mortality studies if such compilations and reports do not identify individual cases and sources of information.15 The Oregon Health Authority may disclose information from the prescription monitoring program that does not identify a patient, practitioner or drug outlet for educational, research or public health purposes; and to officials of the authority who are conducting special epidemiologic morbidity and mortality studies.16  The Office for Oregon Health Policy and Research may authorize the disclosure of health data in accordance with a data use agreement with a researcher for purposes of research, public health, or health care operations.17

        There are a number of requirements surrounding disclosure of disease-specific information.  Clinical laboratories may disclose HIV/AIDS test information for treatment purposes to the person ordering the test, to persons who must review a medical record for treatment, and as otherwise permitted by federal law.18  All identifying information reported for use in the Childhood Diabetes Database must remain confidential;19 collected information may only be used for approved research and studies.20  All identifying information about cases of cancer or benign tumors that is required to be reported must be kept confidential.21  Facilities and practitioners that report cases of cancer or benign tumors may access confidential data on any case submitted by that facility or practitioner; when a patient has been seen by multiple facilities or practitioners, the public health division may share information on treatment and follow-up among those involved with the patient’s care.22

        Oregon also maintains a number of health-related registries, which all have requirements surrounding the disclosure of the information contained therein.  Information in an immunization registry or information derived from the registry or record is confidential and may only be disclosed to those who have been specifically authorized to receive such information.23  Individually identifiable information may be released from the Oregon Trauma Registry if it is to be used for specific case reviews, for quality assurance or quality improvement purposes, or for research approved by an institutional review board.24  Information contained in the Physician Orders for Life-Sustaining Treatment (POLST) Registry may only be released to authorized persons, facilities and researchers, and for authorized purposes.25  The information reported to the central cancer registry may be disclosed for purposes directly related to the registry, and in a number of other circumstances, including when the public health division has entered into a reciprocal cooperative agreement with other states and when the division contracts with another agency with comparable confidentiality protections for performance of a registry function.26

        Finally, information that is required to be reported may be disclosed under certain circumstances. The Oregon Health Authority may disclose prescription monitoring to a treating practitioner or pharmacist, to a health professional regulatory board for purposes of an investigation and to a prescription monitoring authority of another state. 27  The Oregon Health Authority may require the owner or director of a laboratory to submit initial findings indicative of communicable diseases; information contained in these reports may be disclosed for purposes of administering the public health laws and may be used to compile statistical and other data if persons are not identified.28

 

 

Footnotes

  • 1. Or. Rev. Stat. §192.518
  • 2. Or. Rev. Stat. § 443.739
  • 3. Or. Rev. Stat. § 441.605
  • 4. Or. Admin. R. 333-027-0080
  • 5. Or. Admin. R. 333-536-0060
  • 6. Or. Admin. R. 309-032-1515
  • 7. Or. Rev. Stat. § 743.804
  • 8. Or. Rev. Stat. §192.520
  • 9. Or. Rev. Stat. § 441.605
  • 10. Or. Rev. Stat. § 441.117
  • 11. Or. Admin. R. 333-003-0050
  • 12. Or. Rev. Stat. § 433.443
  • 13. Or. Rev. Stat. §433.008    
  • 14. Or. Admin R. 407-014-0060
  • 15. Or. Rev. Stat. § 432.060
  • 16. Or. Rev. Stat. § 431.966
  • 17. Or. Admin. R. 409-022-0070
  • 18. Or. Rev. Stat. § 433.045
  • 19. Or. Rev. Stat. § 444.330
  • 20. Or. Admin. R. 333-010-0640
  • 21. Or. Rev. Stat. § 432.530
  • 22. Or. Admin. R. 333-010-0050
  • 23. Or. Rev. Stat. § 433.098
  • 24. Or. Rev. Stat. § 431.635
  • 25. Or. Admin. R. 333-270-0060
  • 26. Or. Admin. R. 333-010-0050
  • 27. Or. Rev. Stat. § 431.966
  • 28. Or. Rev. Stat. § 438.310

 

Privacy and Confidentiality in Oregon

Subtopic Statute/Regulation Description
Disclosure requirements (what providers can disclose, prohibition on further disclosure) Or. Admin. R. 333-049-0100 - Confidentiality Personal identifying information from the immunization registry may only be disclosed to authorized users.  Any request for limitations on the...
Or. Admin. R. 333-010-0055 - Research Studies The Oregon Health Authority’s Public Health Division may disclose confidential data from the cancer registry system to a researcher if the...
Or. Admin. R. 407-014-0030 - Client Privacy Rights Client, defined as individuals requesting services from the Department of Human Services, including recipients of public assistance, may access,...
Or. Admin. R. 409-022-0070 - Limited Data Sets with a Data Use Agreement The Office for Oregon Health Policy and Research may authorize the disclosure of health data in accordance with a data use agreement entered into by...
Or. Admin. R. 410-141-0180 - Oregon Health Plan Prepaid Health Plan Record Keeping Prepaid Health Plans (PHPs) and participating providers must have written policies and procedures to ensure that individually identifiable health...
Or. Admin. R. 411-045-0100 - Confidentiality and Reporting Each Program of All-Inclusive Care for the Elderly (PACE) must have written policies and procedures to assure that participants’ clinical...
Or. Rev. Stat. § 192.538 - Notice by health care provider regarding anonymous or coded research Health care providers that obtain individuals’ biological specimen or clinical individually identifiable health information are required to...
Or. Rev. Stat. § 192.558 - Health care provider and state health plan authority A health care provider or state health plan may use or disclose protected health information as authorized by the patient or the patient’s...
Or. Rev. Stat. § 192.558 - Health care provider and state health plan authority A health care provider or state health plan can use or disclose protected health information if authorized by the patient or the patient’s...
Or. Rev. Stat. § 192.581 - Allowed Retention or Disclosure of Genetic Information A health care provider may retain an individual’s genetic information without obtaining authorization from the individual or his or her...
Or. Rev. Stat. § 192.581 - Allowed Retention or Disclosure of Genetic Information A health care provider can retain an individual’s genetic information without obtaining the person’s authorization if it is for treatment...
Or. Rev. Stat. § 432.550 - Action for damages A person cannot be held liable for the disclosure of confidential information relating to the good faith reporting to the cancer or benign tumor...
Or. Rev. Stat. § 433.045 - Consent to HIV test required Clinical laboratories may disclose HIV/AIDS test information for treatment purposes to the person ordering the test, to persons who must review a...
Or. Rev. Stat. § 433.098 - Nonliability for disclosing or using information Information in an immunization registry regarding a client’s immunization record or tracking and recall record, or information derived from the...
Or. Rev. Stat. § 433.280 - Status of immunization records as public records Local health departments may release information about a person’s immunization status against restrictable diseases to school administrators...
Or. Rev. Stat. § 433.443 - Authority of Public Health Director during public health emergency During a proclaimed state of public health emergency, the Public Health Director may adopt reporting requirements for providers, institutions and...
Or. Rev. Stat. § 438.310 - Inspection of laboratory premises The Oregon Health Authority may inspect the laboratory results and records of any clinical laboratory.  The authority may require the owner or...
Or. Rev. Stat. § 441.113 - Procedures to maintain confidentiality The Long Term Care Ombudsman must establish procedures to maintain the confidentiality of the records and files of residents of long term care...
Or. Rev. Stat. § 442.844 - Patient safety data Patient safety data reported to the Oregon Patient Safety Commission and information developed pursuant to the auditing and oversight aspects of the...
Or. Rev. Stat. § 443.769 - Public disclosure of investigatory information When the Department of Human Services or a type B area agency on aging discloses a file, form or report to the public related to adult foster home...
Or. Rev. Stat. § 743.839 - Disclosure of information Information that is privileged or confidential under any other provision of law is not required to be disclosed for insurance purposes.
Or. Rev. Stat. § 746.665 - Limitations and conditions on disclosure of certain information A licensee or insurance-support organization may disclose personal or privileged information about an individual collected or received with an...
Or. Rev. Stat. §192.553 - Policy for protected health information It is Oregon's policy that an individual has the right to have his or her protected health information safeguarded from unlawful use or disclosure,...
Or. Rev. Stat. §192.553 - Policy for protected health information Oregon’s policy is that individual health information must be protected from unlawful use or disclosure.  It also provides that an...
Or. Rev. Stat. §433.008 - Confidentiality of disclosure Information obtained by the Oregon Health Authority or a local public health administrator during an investigation of a reportable disease or disease...
Or. Rev. Stat. §442.831 - Powers of board relating to Oregon Patient Safety Reporting Program In implementing the Patient Safety Reporting Program, the Oregon Patient Safety Commission Board of Directors must maintain the confidentiality of...
Patient’s right to confidentiality of medical records/medical information Or. Admin. R. 333-049-0100 - Confidentiality Personal identifying information from the immunization registry may only be disclosed to authorized users.  Any request for limitations on the...
Or. Admin. R. 410-120-1360 - Requirements for Financial, Clinical and Other Records Medicaid participating providers must maintain financial and clinical records.  The records must be well documented and be complete before...
Or. Admin. R. 309-032-0870 - Standards for Approval of Regional Acute Care Psychiatric Service In order to be granted approval for operation, regional acute care psychiatric services must comply with the following requirements: Maintain...
Or. Admin. R. 309-040-0390 - Standards and Practices for Care and Services Adult Foster Homes must comply with a number of standards for care and services, including the following: Maintain a copy of medication,...
Or. Admin. R. 309-040-0410 - Residents’ Rights, Complaints, and Grievances Each resident of an adult foster home has a number of rights, including: Be informed of the resident’s medical condition Be informed of...
Or. Admin. R. 333-004-0060 - Standards of Care for Contraceptive Management Services Providers participating in the Family Planning Expansion Program must agree to provide contraceptive management services according to the following...
Or. Admin. R. 333-004-0120 - Requirements for Financial, Clinical and Other Records The Office of Family Health is responsible for analyzing and monitoring the operation of the Family Planning Expansion Program and for auditing and...
Or. Admin. R. 333-010-0050 - Confidentiality and Access to Data All identifying information regarding individual patients, cancer reporting facilities, and practitioners required to be reported to the central...
Or. Admin. R. 333-010-0640 - Confidentiality and Access to Data All identifying information required to be reported by practitioners and schools to the Childhood Diabetes Database is confidential.  The...
Or. Admin. R. 333-027-0080 - Patients' Rights Each patient of a home health agency has a number of rights, including the following: To be informed, in advance, about the care to be furnished...
Or. Admin. R. 333-200-0090 - Trauma Hospitals The Public Health Division of the Oregon Health Authority will accredit trauma system hospitals after evaluating and approving a hospital’s...
Or. Admin. R. 333-270-0060 - Confidentiality of Registry Information Information contained in the Physician Orders for Life-Sustaining Treatment (POLST) Registry may only be released to authorized persons, facilities...
Or. Admin. R. 333-536-0060 - Clients’ Rights Clients of in-home care agencies have a number of a rights, including the following: To be given the informed choice and opportunity to select or...
Or. Admin. R. 333-700-0090 - Medical Records Each renal dialysis facility must maintain complete medical records on all patients; each record must contain sufficient information to identify the...
Or. Admin. R. 407-014-0020 - Uses and Disclosures of Client or Participant Protected Information The Department of Human Services, Administrative Services Division must obtain a completed and signed authorization for release of information from...
Or. Admin. R. 407-014-0020 - Uses and Disclosures of Client or Participant Protected Information Substance abuse treatment information is confidential and privileged to the patient, and may only be disclosed in accordance with Part 2, as stated...
Or. Admin. R. 409-022-0060 - Access to Health Data The limited data set that is derived from the health care utilization data reported by general acute care hospitals and ambulatory surgical...
Or. Admin. R. 410-121-0143 - Client Confidentiality Pharmacists must maintain the confidentiality of client information in compliance with HIPAA standards.
Or. Admin. R. 410-141-0180 - Oregon Health Plan Prepaid Health Plan Record Keeping Prepaid Health Plans (PHPs) and participating providers must have written policies and procedures to ensure that individually identifiable health...
Or. Admin. R. 410-141-0720 - Oregon Health Plan Primary Care Manager Medical Record Keeping A Primary Care Manager (PCM) is a health care provider that agrees to provide primary care management services to an Oregon Health Plan client...
Or. Admin. R. 411-045-0100 - Confidentiality and Reporting Each Program of All-Inclusive Care for the Elderly (PACE) must have written policies and procedures to assure that participants’ clinical...
Or. Admin. R. 411-085-0310 - Residents’ Rights: Generally All residents in a nursing facility have the following rights: To be fully informed of one’s health and medical status; To be fully...
Or. Admin. R. 411-085-0370 - Confidentiality The names of nursing home residents and any documentation that identifies residents are confidential and not available for public inspection. ...
Or. Admin. R. 847-017-0020 - Patient Medical Records A comprehensive medical record must be maintained for each patient who is evaluated or treated in an office-based surgery setting.  The record...
Or. Rev. Stat. § 430.763 - Confidentiality of records The names of the affected adults in abuse reports are confidential and not accessible for public inspection.  The Department of Human Services...
Or. Rev. Stat. § 432.530 - Confidentiality of information All identifying information about cases of cancer or benign tumors that is required to be reported must be kept confidential.  Any additional...
Or. Rev. Stat. § 432.540 - Use of confidential data The Oregon Health Authority establishes the rules for when confidential data regarding cancer or benign tumor cases can be used to conduct research...
Or. Rev. Stat. § 433.098 - Nonliability for disclosing or using information Information in an immunization registry regarding a client’s immunization record or tracking and recall record, or information derived from the...
Or. Rev. Stat. § 441.113 - Procedures to maintain confidentiality The Long Term Care Ombudsman must establish procedures to maintain the confidentiality of the records and files of residents of long term care...
Or. Rev. Stat. § 441.605 - Legislative declaration of rights intended for residents Residents of nursing homes are guaranteed several rights, including the following: To be fully informed by a physician of the medical condition...
Or. Rev. Stat. § 442.837 - Oregon Patient Safety Reporting Program The Oregon Patient Safety Commission established Oregon Patient Safety Reporting Program.  Participation in the program is voluntary, and will...
Or. Rev. Stat. § 442.846 - Patient safety data not admissible in civil actions Patient safety data and reports obtained by the Patient Safety Reporting Program is confidential and privileged and cannot be used as evidence in any...
Or. Rev. Stat. § 443.739 - Rights of residents Residents of adult foster homes have a number of rights that include the following: To be informed of the resident’s medical condition;...
Or. Rev. Stat. § 444.330 - Confidentiality of information All identifying information reported to the Oregon Health Authority for use in the Childhood Diabetes Database must remain confidential. ...
Or. Rev. Stat. §192.553 - Policy for protected health information It is Oregon's policy that an individual has the right to have his or her protected health information safeguarded from unlawful use or disclosure,...
Or. Rev. Stat. §192.553 - Policy for protected health information Oregon’s policy is that individual health information must be protected from unlawful use or disclosure.  It also provides that an...
Or. Rev. Stat. §441.671 - Confidentiality of reports The names of complainants and residents used in reports of patient abuse in long term care facilities must remain confidential and are not subject to...
Or. Rev. Stat. §442.831 - Powers of board relating to Oregon Patient Safety Reporting Program In implementing the Patient Safety Reporting Program, the Oregon Patient Safety Commission Board of Directors must maintain the confidentiality of...
Disclosure of medical information for research purposes (Cross reference Research) Or. Admin R. 407-014-0060 - Uses and Disclosures of Protected Information for Research Purposes All disclosures of protected health information for research purposes are subject to state and federal law.  The Department of Human Services...
Or. Admin. R. 333-010-0650 - Research Studies A researcher may obtain confidential data from the Childhood Diabetes Database upon obtaining approval from the Oregon Health Authority’s...
Or. Rev. Stat. § 438.430 - Examination, specimens A clinical laboratory must report the result of any test, examination or analysis of a submitted specimen submitted to the patient, to the provider...
Privacy and Confidentiality Or. Admin. R. 114-005-0030 - Access to Records The Long Term Care Ombudsman and his designees may access any long term care resident’s records with the written authorization of the resident...
Or. Admin. R. 309-014-0035 - General Standards for Delivery of Community Mental Health and Developmental Disability Service Elements All community mental health and developmental disability contractors providing services under a contract with the Oregon Health Authority’s...
Or. Admin. R. 333-003-0050 - Access to Individually Identifiable Health Information During a declared public health emergency, the Public Health Director and local public health administrators will have immediate access to...
Or. Admin. R. 333-010-0060 - Special Studies The Oregon Health Authority’s Public Health Division may conduct special studies of cancer mortality and morbidity, and is authorized to obtain...
Or. Admin. R. 333-018-0140 - Prohibited Activities Unless specifically required by law, the Office for Oregon Health Policy and Research is prohibited from disclosing patient information,...
Or. Admin. R. 333-025-0120 - Anonymous, Coded, or Exempt Genetic Research A human biological sample or clinical individually identifiable health information may be used in anonymous or coded genetic research only if, prior...
Or. Admin. R. 333-049-0070 - Limitations on Access to Information in the Immunization Registry and Tracking and Recall System No authorized user of the immunization registry may access information from the registry about a client who is not currently under their care or...
Or. Admin. R. 333-270-0080 - Access to Registry Information by Researchers The Oregon Health Authority may release information from the Physician Orders for Life-Sustaining Treatment (POLST) Registry to researchers for...
Or. Admin. R. 410-121-4020 - Information Access The Prescription Drug Monitoring Program system may be accessed by practitioners and pharmacists authorized to prescribe or dispense controlled...
Or. Rev. Stat. § 179.505 - Patient record inspection, disclosure, or release by provider Records and information relating to the mental health of an individual are confidential and privileged to the patient, and may only be disclosed in...
Or. Rev. Stat. § 413.196 - Confidentiality and inadmissibility of information obtained in connection with epidemiologic morbidity and mortality studies All information relating to special epidemiologic morbidity and mortality studies, including written reports, notes, records, statements and studies...
Or. Rev. Stat. § 431.966 - Disclosure of information Patient data submitted as part of the prescription monitoring program is considered protected health information and is not subject to disclosure as...
Or. Rev. Stat. § 441.117 - Right of entry into facilities and access to records The Long Term Care Ombudsman will have access to any long term care facility resident’s records, and to necessary records of any public agency...
Or. Rev. Stat. §432.350 - Vital records exempt from public disclosure It is unlawful for any person to allow an unauthorized person to inspect, disclose, or copy information from vital records or reports in the...
Confidentiality and disclosure requirements of peer review information (Cross reference to Medical Peer Review) Or. Admin. R. 114-005-0040 - Confidentiality of Records The identity of residents and complainants is confidential and will not be disclosed unless: The resident or his legal representative gives...
Confidentiality and disclosure requirements of public health reporting information (disease specific information/registry data) (Cross reference to Public Health Reporting) Or. Admin. R. 114-005-0040 - Confidentiality of Records The identity of residents and complainants is confidential and will not be disclosed unless: The resident or his legal representative gives...
Confidentiality of medical records Or. Admin. R. 333-009-0030 - Confidentiality/Liability All information collected via the Oregon Death with Dignity Act, including the identity of patients, is not a public record and may not be made...
Or. Admin. R. 333-076-0690 - Health and Medical Records Birthing Centers must maintain health and clinical records for each client and must store such records to prevent access by unauthorized persons....
Authorization for disclosure and exceptions to authorization requirements Or. Rev. Stat. § 410.480 - Required record keeping Each authorized agency and service provider for Oregon Project Independence shall maintain books, records, documents and accounting procedures which...