Deploys a mental-health chatbot, in Oregon

ORS 646A.622 (2007 c.759 sec. 12; amended 2015 c.357 sec. 3; 2018 c.10 sec. 6; 2019 c.180 sec. 4) · Read the law's page

• Develop, implement and maintain reasonable administrative, technical and physical safeguards to protect the security, confidentiality and integrity of personal information, including its secure disposal.
• Satisfy this duty either by already being subject to and complying with Gramm-Leach-Bliley Act Title V regulations, HIPAA and HITECH regulations, or another state or federal law providing greater protection, or by implementing an information security program with a designated coordinator, a periodic risk assessment, employee training, vetted service-provider contracts, network and software risk assessment and patch management, attack detection and testing, and secure destruction of records when the information is no longer needed.
• A small business may scale its program's administrative, technical and physical safeguards to its own size, complexity and the sensitivity of the personal information it collects.
• This binds a covered entity, any person, including a public body, that owns, licenses, maintains, stores, manages, collects, processes, acquires or otherwise possesses an Oregon consumer's personal information in the course of business, vocation, occupation or volunteer activity, and a vendor the covered entity contracts with to hold that information on its behalf; a person who acts solely as a vendor is not itself a covered entity.
• The Director of the Department of Consumer and Business Services enforces this duty by investigation, subpoena and a cease-and-desist order, with a civil penalty of up to $1,000 per violation and up to $500,000 for any one occurrence; the sections name no private right of action of their own.

ORS 678.027 · Read the law's page

• Do not have a nonhuman entity, including an AI-powered agent, use the title or abbreviation of Advanced Practice Registered Nurse, certified registered nurse anesthetist, clinical nurse specialist, licensed practical nurse, registered nurse, nurse practitioner, certified medication aide or certified nursing assistant.

ORS 165.535, 165.540, 165.543, 165.545 · Read the law's page

• Do not obtain, or attempt to obtain, the whole or any part of a telecommunication or radio communication to which you are not a participant, unless at least one participant has consented.
• Do not obtain any part of an in-person conversation or a conversation occurring through a video conferencing program by means of a recording device unless every participant is specifically informed that the conversation is being obtained, whether or not you are yourself a participant.
• The specific-notice duty does not apply to a public or semipublic meeting, hearing, trial, press conference, rally or similar event recorded with an unconcealed device or held over a video conferencing program, to a regularly scheduled class, or to a private meeting or conference where all others involved knew or reasonably should have known the recording was being made.
• Do not obtain a conversation, telecommunication or radio communication from another person while knowing or having good reason to believe it was first obtained in a way the section prohibits, and do not use or divulge one obtained by prohibited means, unless you took no part in first obtaining it and it concerns a matter of public concern.