Oregon law enacts measures to ensure that health information is protected from unauthorized access or disclosure by requiring the use of various security measures and penalizing violations of these measures. 

        Various facilities and providers are required to maintain specific security measures.  All health care facilities’ medical records must be protected from unauthorized access; if records are moved to an off-site storage facility, precautions must be taken to protect patient confidentiality.1  Each renal dialysis facility must safeguard medical record information against unauthorized use.2 Every in-home care agency must take precautions to protect clients’ medical records from unauthorized access.3  Providers participating in the Family Planning Expansion Program must implement security measures that protect the confidentiality of the program’s eligibility database and prevent unauthorized access to or disclosure of information from the database; such providers must report any incidents that compromise, damage or cause a loss of protection to the database.  Wrongful use or disclosure of the database may cause immediate suspension or revocation of any access granted.4

        In addition to providers and facilities, the state is required to maintain security measures for various databases, registries and collected information.  The information collected for the childhood diabetes database must be stored in a physically and technologically secure manner.5  Precautions must be taken to prevent the unauthorized disclosure of hospital outcome measure raw data files, including storing the data on a password protected personal computer, restricting staff and network access to the raw data files, and using strong encryption coding.6  The state’s prescription monitoring system has several security measures in place.  The Oregon Health Authority monitors the system for unusual and potentially unauthorized use; if such use is detected, the user account will be immediately deactivated.  Vendors, practitioners, pharmacists and pharmacies must report any suspected breach of the system or unauthorized access.  If the patient data has been breached or accessed without proper authorization, the authority will notify all affected patients, the Attorney General and the applicable health professional regulatory board.7