Law / United States / 
Oregon
Oregon protected health information statutes: authorization, use and disclosure by health care providers and state health plans
In force.
A sensitive categories rule binding public and private bodies.
- Obligation class
- Consent, Disclosure, Data subject rights
- Audit expectation
- none
As of .
What it requires
- If you rely on an authorization to use or disclose protected health information, use a document written in plain language that contains the elements ORS 192.556(1) lists, including an expiration date or event, the signature and date, and statements on revocation, on conditioning treatment and on redisclosure (ORS 192.556(1)).
- If you are a health care provider or state health plan, use or disclose protected health information in a manner consistent with an authorization, or without one for your own treatment, payment or health care operations or as state or federal law or a court order permits or requires (ORS 192.558(1), (2)).
- Limit any disclosure of protected health information to a family member, friend or other person involved in the individual's care, or to notify such a person of the individual's location, condition or death, to the minimum necessary to accomplish the purpose (ORS 192.567(1), (4)).
- Charge no more than $30 for copying 10 or fewer pages, 50 cents per page for pages 11 through 50 and 25 cents for each additional page when you disclose protected health information under an authorization, plus postage and the actual cost of an explanation or summary the individual requests (ORS 192.563).
- If you are a covered entity, give an individual appealing the denial of Social Security disability benefits, on request, one copy of the individual's health information created between the alleged onset of disability and the administrative hearing, free of charge and in paper or electronic format at the individual's election (ORS 192.576(1)).
- If you are a health care provider that participates in a coordinated care organization, disclose protected health information to the other participating providers for treatment and to the organization for health care operations and payment, and to public health entities as required for health oversight (ORS 192.561(1)).
These lines are LexLint's reading of the law's text, as of .
What this law does
ORS 192.553 states the policy of the State of Oregon that an individual has the right to have protected health information safeguarded from unlawful use or disclosure and the right to access and review it. A covered entity is a state health plan, a health insurer, a health care provider that transmits health information in electronic form in connection with a transaction covered by ORS 192.553 to 192.581, or a health care clearinghouse.
Protected health information is individually identifiable health information that is maintained or transmitted in any form of electronic or other medium by a covered entity. Protected health information does not include individually identifiable health information in education records covered by the federal Family Educational Rights and Privacy Act or in employment records held by a covered entity in its role as employer.
A health care provider or state health plan may use or disclose protected health information consistent with an authorization, and without one for its own treatment, payment or health care operations or as otherwise permitted or required by state or federal law or by order of the court.
An authorization is a document written in plain language that contains the description of the information, the persons authorized to disclose and receive it, each purpose, an expiration date or event, the signature and date, the authority of any personal representative, and statements on revocation, conditioning of treatment and redisclosure.
A health care provider or state health plan that receives an authorization to disclose protected health information may charge no more than $30 for copying 10 or fewer pages, no more than 50 cents per page for pages 11 through 50 and no more than 25 cents for each additional page. Any disclosure of protected health information under ORS 192.567 must be limited to the minimum necessary to accomplish the purpose of the disclosure.
A covered entity must, on request of an individual appealing the denial of Social Security disability benefits, provide one copy of the individual's health information free of charge. A health care provider that participates in a coordinated care organization must disclose protected health information to the other participating providers for treatment and to the organization for health care operations and payment.
Nothing in ORS 192.556 or 192.558 may be construed to create a new private right of action against a health care provider or a state health plan.
When LexLint raises it
When your app profile says your app handles health records.