Or. Admin. Code § 125-055-0125 - Methods of Compliance

In addition to referencing compliance with this Rule in a Contract with a Business Associate, Agency may comply with this Rule in any of the following ways:

(1) Memorandum of Understanding. If a Business Associate is a government entity, the parties may comply with the requirements of this Rule by entering into a memorandum of understanding that accomplishes the objectives of this Rule and meets the Business Associate requirements of the Privacy Rule and the Security Rule.

(2) Amendment. Agency may comply with the requirements of this Rule by executing an amendment or rider that amends Agency's Contract and that contains the contract provisions required by this Rule.

(3) Required by Law. If a Business Associate is Required by Law to perform a function or activity on behalf of an Agency or to provide a service described in the definition of Business Associate to an Agency, such Agency may disclose Protected Health Information to the Business Associate to the extent necessary to comply with the legal mandate without meeting the requirements of this Rule, provided that the Agency attempts in good faith to obtain satisfactory assurances required by OAR 125-055-0115, and, if such attempt fails, documents the attempt and the reasons that such assurances cannot be obtained.

Notes

Or. Admin. Code § 125-055-0125

DAS 9-2002(Temp), f. & cert. ef. 12-31-02 thru 6-28-03; DAS 3-2003, f. & cert. ef. 6-27-03; DAS 5-2005(Temp), f. & cert. ef. 4-20-05 thru 10-17-05; DAS 12-2005, f. 10-21-05, cert. ef. 10-22-05; DAS 2-2010(Temp), f. & cert. ef. 7-26-10 thru 1-17-11; DAS 4-2010, f. & cert. ef. 11-15-10; DAS 4-2013, f. 12-17-13, cert. ef. 1-1-14

Stat. Auth.: ORS 184.305, 184.340 & 279A.140

Stats. Implemented: ORS 279A.140 & The Health Insurance Portability and Accountability Act of 1996, 42 USC 1320 d -1320d-8, PL 104-191, sec. 262& sec. 264