Processes de-identified data, in Oregon

ORS 646A.570(11), 646A.583 · Read the law's page

• If you hold deidentified data, take reasonable measures to ensure that it cannot be associated with an individual (ORS 646A.583(1)(a)(A)).
• Publicly commit to maintaining and using the deidentified data without attempting to reidentify it, except that you may attempt to reidentify it solely to test your deidentification methods (ORS 646A.583(1)(a)(B) and (1)(c)).
• Enter into a contract with each recipient of the deidentified data requiring the recipient to comply with your obligations under ORS 646A.570 to 646A.589 (ORS 646A.583(1)(a)(C)).
• If you disclose deidentified data, exercise reasonable oversight to monitor compliance with the contractual commitments the data is subject to, and take appropriate steps to address any breach of them (ORS 646A.583(1)(b)).

ORS 746.665(1)(i) · Read the law's page

• If you are an insurance licensee or insurance-support organization, disclose personal or privileged information about an individual for an actuarial or research study only if no individual may be identified in any resulting actuarial or research report (ORS 746.665(1)(i)(A)).
• Make sure materials that allow the individual to be identified are returned or destroyed as soon as they are no longer needed (ORS 746.665(1)(i)(B)).
• Have the actuarial or research organization agree not to disclose the information unless the disclosure would otherwise be permitted by ORS 746.665 if made by a licensee or insurance-support organization (ORS 746.665(1)(i)(C)).
• This condition does not apply to a health insurer (ORS 746.609).