Or. Admin. Code § 137-003-0573 - Individually Identifiable Health Information

(1) This rule is intended to facilitate the issuance of a Qualified Protective Order (QPO) by an administrative tribunal in a contested case proceeding. The process described in this rule may be used by an agency or party to a contested case proceeding to request information from Covered Entities by using a QPO. This rule is intended to comply with federal requirements of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the HIPAA Privacy Rules in 45 CFR Parts 160 and 164 to protect the privacy of Protected Health Information. This rule should be construed to implement and not to alter the requirements of 45 CFR § 164.512(e).

(2) For purposes of this rule, capitalized terms used but not otherwise defined in this rule have the meaning given those terms in the HIPAA Privacy Rules in 45 CFR Parts 160 and 164.

(a) An agency or administrative law judge who conducts a contested case hearing on behalf of an agency is an "administrative tribunal," as that term is used in 45 CFR § 164.512(e).

(b) The HIPAA Privacy Rules define "Covered Entity" to include the following entities, as further defined in the HIPAA Privacy Rules:

(A) A Health Insurer or the Medicaid program;

(B) A Health Care Clearinghouse; or

(C) A Health Care Provider that transmits any Individually Identifiable Health Information using Electronic Transactions covered by HIPAA.

(3) An administrative tribunal may issue a QPO at the request of a party, a Covered Entity, an Individual, or the agency.

(a) A request for a QPO may be accompanied by a copy of the subpoena, discovery request, or other lawful process that requests Protected Health Information from a Covered Entity.

(b) If the Individual has signed an authorization permitting disclosure of the Protected Health Information for purposes of the contested case proceeding, the administrative tribunal need not issue a QPO.

(4) A QPO is an order of the administrative tribunal that:

(a) Prohibits the use or disclosure of Protected Health Information by the agency or parties for any purpose other than the contested case proceeding or judicial review of the contested case proceeding;

(b) Requires that all copies of the Protected Health Information be returned to the Covered Entity or destroyed at the conclusion of the contested case proceeding, or judicial review of the contested case proceeding, whichever is later; and

(c) Includes such additional terms and conditions as may be appropriate to comply with federal or state confidentiality requirements that apply to the Protected Health Information.

(5) This rule addresses only the process for requesting a QPO from an administrative tribunal in a contested case hearing. This rule does not address any claims or defenses related to the admissibility or confidentiality of Protected Health Information for purposes of discovery or the hearing.

(6) The provisions of this rule do not supercede any other provisions of the HIPAA Privacy Rules that otherwise permit or restrict uses or disclosure of Protected Health Information without the use of a QPO.

(7) This rule applies to all contested cases that are either pending or initiated on or after April 14, 2003.

Notes

Or. Admin. Code § 137-003-0573

DOJ 2-2003, f. 3-19-03, cert. ef. 4-1-03; DOJ 19-2003, f. 12-12-03, cert. ef. 1-1-04

Publications: Publications referenced are available from the agency.

Stat. Auth.: ORS 183.341, HIPAA 1996, 45 CFR part 160 &164

Stats. Implemented: ORS 183.341, Or. Law 1999, 849