Or. Admin. Code § 407-014-0020 - Uses and Disclosures of Client or Participant Protected Information
(1) Uses and
disclosures with individual authorization. The Department must obtain a
completed and signed authorization for release of information from the
individual, or the individual's personal representative, before obtaining or
using protected information about an individual from a third party or
disclosing protected information about the individual to a third party.
(a) Uses and disclosures must be consistent
with what the individual has approved on the signed authorization form approved
by the Department.
(b) An
individual may revoke an authorization at any time. The revocation must be in
writing and signed by the individual, except that substance abuse treatment
patients may orally revoke an authorization to disclose information obtained
from substance abuse treatment programs. No revocation shall apply to
information already released while the authorization was valid and in
effect.
(2) Uses and
disclosures without authorization. The Department may use and disclose
information without written authorization in the following circumstances:
(a) The Department may disclose information
to individuals who have requested disclosure to themselves of their
information, if the individual has the right to access the information under
OAR 407-014-0030(6).
(b) If the law requires or permits the
disclosure, and the use and disclosure complies with, and is limited to, the
relevant requirements of the relevant law.
(c) For treatment, payment, and health care
operations, the Department may disclose the following information:
(A) Activities involving the current
treatment of an individual, for the Department or health care
provider;
(B) Payment activities,
for the Department, covered entity, or health care provider;
(C) Protected health information for the
purpose of health care operations; and
(D) Substance abuse treatment information, if
the recipient has a Qualified Service Organization Agreement with the
Department.
(d)
Psychotherapy notes. The Department may only use and disclose psychotherapy
notes in the following circumstances:
(A) In
the Department's supervised counseling training programs;
(B) In connection with oversight of the
originator of the psychotherapy notes; or
(C) To defend the Department in a legal
action or other proceeding brought by the individual.
(e) Public health activities.
(A) The Department may disclose an
individual's protected information to appropriate entities or persons for
governmental public health activities and for other purposes including but not
limited to:
(i) A governmental public health
authority that is authorized by law to collect or receive protected information
for the purpose of preventing or controlling disease, injury, or disability,
including but not limited to reporting disease, injury, and vital events such
as birth or death, and conducting public health surveillance, investigations,
and interventions;
(ii) An official
of a foreign government agency that is acting in collaboration with a
governmental public health authority;
(iii) A governmental public health authority,
or other government authority that is authorized by law to receive reports of
child abuse or neglect;
(iv) A
person subject to the jurisdiction of the federal Food and Drug Administration
(FDA), regarding an FDA-regulated product or activity for which that person is
responsible for activities related to the quality, safety, or effectiveness of
an FDA-regulated product or activity; or
(v) A person who may have been exposed to a
communicable disease, or may be at risk of contracting or spreading a disease
or condition.
(B) Where
state or federal law prohibits or restricts use and disclosure of information
obtained or maintained for public health purposes, the Department shall deny
the use and disclosure.
(f) Child abuse reporting and investigation.
If the Department has reasonable cause to believe that a child is a victim of
abuse or neglect, the Department may disclose protected information to
appropriate governmental authorities authorized by law to receive reports of
child abuse or neglect (including reporting to the Department protective
services staff if appropriate). If the Department receives information as the
child protective services agency, the Department may use and disclose the
information consistent with its legal authority and in compliance with any
applicable state and federal regulations.
(g) Adult abuse reporting and investigation.
If the Department has reasonable cause to believe that a vulnerable adult is a
victim of abuse or neglect, the Department may disclose information, as
required by law, to a government authority or regulatory agency authorized by
law to receive reports of abuse or neglect including but not limited to a
social service or protective services agency (which may include the Department)
authorized by law to receive such reports. Vulnerable adults are adults age 65
or older and persons with disabilities. If the Department receives information
as the social services or protective services agency, the Department may use
and disclose the information.
(h)
Health oversight activities. The Department may disclose information without
authorization for health oversight activities including audits; civil,
criminal, or administrative investigations, prosecutions, licensing or
disciplinary actions; Medicaid fraud; or other necessary oversight
activities.
(i) Administrative and
court hearings, grievances, investigations, and appeals.
(A) The Department may use or disclose
information for an investigation, administrative or court hearing, grievance,
or appeal about an individual's eligibility or right to receive Department
benefits or services.
(B) If the
Department has obtained information in performing its duties as a health
oversight agency, protective service entity, or public benefit program, the
Department may use or disclose that information in an administrative or court
hearing consistent with the other privacy requirements applicable to that
program, service, or activity.
(j) Court orders. The Department may disclose
information for judicial or administrative proceedings in response to a court
order, subpoena, discovery request, or other legal process. If a court orders
the Department to conduct a mental examination pursuant to ORS
161.315,
161.365,
161.370, or
419B.352, or orders the
Department to provide any other report or evaluation to the court, the
examination, report, or evaluation shall be deemed to be required by law for
purposes of HIPAA.
(k) Law
enforcement purposes. For limited law enforcement purposes, the Department may
report certain injuries or wounds; provide information to identify or locate a
suspect, victim, or witness; alert law enforcement of a death as a result of
criminal conduct; and provide information which constitutes evidence of
criminal conduct on Department premises.
(A)
The Department may provide client information to a law enforcement officer in
any of the following situations:
(i) The law
enforcement officer is involved in carrying out any investigation, criminal, or
civil proceedings connected with administering the program from which the
information is sought;
(ii) A
Department employee may disclose information from personal knowledge that does
not come from the client's interaction with the Department;
(iii) The disclosure is authorized by statute
or administrative rule;
(iv) The
information informs law enforcement of a death as a result of criminal
conduct;
(v) The information
constitutes evidence of criminal conduct on Department premises; or
(vi) The disclosure is necessary to protect
the client or others, and the client poses a threat to his or her safety or to
the safety of others.
(B)
Except as provided in section (2)(k)(C) of this rule, the Department may give a
client's current address, Social Security number, and photo to a law
enforcement officer if the law enforcement officer makes the request in the
course of official duty, supplies the client's name, and states that the
client:
(i) Is a fugitive felon or is
violating parole, probation, or post-prison supervision;
(ii) For all public assistance programs, has
information that is necessary for the officer to conduct official duties, and
the location or apprehension of the client is within the officer's official
duties; or
(iii) For clients only
in the SNAP program, has information that is necessary to conduct an official
investigation of a fugitive felon or person violating parole, probation, or
post-prison supervision.
(C) If domestic violence has been identified
in the household, the Department may not release information about a victim of
domestic violence unless a member of the household is either wanted as a
fugitive felon or is violating parole, probation, or post-prison supervision.
(D) For purposes of this
subsection, a fugitive felon is a person fleeing to avoid prosecution or
custody for a crime, or an attempt to commit a crime, that would be classified
as a felony.
(E) For purposes of
this section, a law enforcement officer is an employee of the Oregon State
Police, a county sheriff's department, or a municipal police department, whose
official duties include arrest authority.
(l) Use and disclosure of information about
deceased individuals.
(A) The Department may
disclose individual information to a coroner or medical examiner for the
purpose of identifying a deceased individual, determining cause of death, or
other duties authorized by law.
(B)
The Department may disclose individual information to funeral directors as
needed to carry out their duties regarding the decedent. The Department may
also disclose individual information prior to, and in anticipation of, the
death.
(m) Organ or
tissue donation. The Department may disclose individual information to organ
procurement organizations or other entities engaged in procuring, banking, or
transplanting cadaver organs, eyes, or tissue for the purpose of facilitating
transplantation.
(n) Research. The
Department may disclose individual information without authorization for
research purposes, as specified in OAR
407-014-0060.
(o) Threat to health or safety. To avert a
serious threat to health or safety the Department may disclose individual
information if:
(A) The Department believes
in good faith that the information is necessary to prevent or lessen a serious
and imminent threat to the health or safety of a person or the public;
and
(B) The report is to a person
or persons reasonably able to prevent or lessen the threat, including the
target of the threat.
(p) National security and intelligence. The
Department may disclose information to authorized federal officials for lawful
intelligence, counterintelligence, and other national security
activities.
(q) Correctional
institutions and law enforcement custody situations. The Department may
disclose information to a correctional institution or a law enforcement
official having lawful custody of an inmate or other person, for the limited
purpose of providing health care or ensuring the health or safety of the person
or other inmates.
(r) Emergency
treatment. In case of an emergency, the Department may disclose individual
information to the extent needed to provide emergency treatment.
(s) Government entities providing public
benefits. The Department may disclose eligibility and other information to
governmental entities administering a government program providing public
benefits.
(3)
Authorization not required if opportunity to object given. The Department may
use and disclose an individual's information without authorization if the
Department informs the individual in advance and gives the individual an
opportunity to either agree or refuse or restrict the use and disclosure.
(a) These disclosures are limited to
disclosure of information to a family member, other relative, close personal
friend of the individual, or any other person named by the individual, subject
to the following limitations:
(A) The
Department may disclose only the protected information that directly relates to
the person's involvement with the individual's care or payment for
care.
(B) The Department may use
and disclose protected information for notifying, identifying, or locating a
family member, personal representative, or other person responsible for care of
the individual, regarding the individual's location, general condition, or
death. For individuals who had resided at one time at the state training
center, OAR 411-320-0090(6)
addresses family reconnection.
(C)
If the individual is present for, or available prior to, a use and disclosure,
the Department may disclose the protected information if the Department:
(i) Obtains the individual's
agreement;
(ii) Provides the
individual an opportunity to object to the disclosure, and the individual does
not object; or
(iii) Reasonably
infers from the circumstances that the individual does not object to the
disclosure.
(D) If the
individual is not present, or the opportunity to object to the use and
disclosure cannot practicably be provided due to the individual's incapacity or
an emergency situation, the Department may disclose the information if, using
professional judgment, the Department determines that the use and disclosure is
in the individual's best interests.
(b) Exception. For individuals referred to or
receiving substance abuse treatment, mental health, or vocational
rehabilitation services, the Department shall not use or disclose information
without written authorization, unless disclosure is otherwise permitted under
42 CFR part 2,
34 CFR
361.38, or ORS 179.505.
(c) Personal representative. The Department
must treat a personal representative as the individual for purposes of these
rules, except that:
(A) A personal
representative must be authorized under state law to act on behalf of the
individual with respect to use and disclosure of information. The Department
may require a personal representative to provide a copy of the documentation
authorizing the person to act on behalf of the individual.
(B) The Department may elect not to treat a
person as a personal representative of an individual if:
(i) The Department has a reasonable belief
that the individual has been or may be subjected to domestic violence, abuse,
or neglect by the person;
(ii) The
Department, in the exercise of professional judgment, decides that it is not in
the best interest of the individual to treat the person as the individual's
personal representative.
(4) Redisclosure. The Department must inform
the individual that information held by the Department and authorized by the
individual for disclosure may be subject to redisclosure and no longer
protected by these rules.
(5)
Specific written authorization. If the use or disclosure of information
requires an authorization, the authorization must specify that the Department
may use or disclose vocational rehabilitation records, alcohol and drug
records, HIV/AIDS records, genetics information, and mental health or
developmental disability records held by publicly funded providers.
(a) Pursuant to federal regulations at 42 CFR
part 2 and
34 CFR
361.38, the Department may not make further
disclosure of vocational rehabilitation and alcohol and drug rehabilitation
information without the specific written authorization of the individual to
whom it pertains.
(b) Pursuant to
ORS 433.045 and OAR 333-012-0270,
the Department may not make further disclosure of individual information
pertaining to HIV/AIDS.
(c)
Pursuant to ORS 192.531 to
192.549, the Department may not
make further disclosure pertaining to genetic information.
(6) Verification of person or entity
requesting information. The Department may not disclose information about an
individual without first verifying the identity of the person or entity
requesting the information, unless the Department workforce member fulfilling
the request already knows the person or has already verified
identity.
(7) Whistleblowers. The
Department may disclose an individual's protected health information under the
HIPAA privacy rules under the following circumstances:
(a) The Department workforce member believes
in good faith that the Department has engaged in conduct that is unlawful or
that otherwise violates professional standards or Department policy, or that
the care, services, or conditions provided by the Department could endanger
Department staff, individuals in Department care, or the public; and
(b) The disclosure is to a government
oversight agency or public health authority, or an attorney of a Department
workforce member retained for the purpose of determining the legal options of
the workforce member with regard to the conduct alleged under section (7)(a)
above; and
(c) Nothing in this rule
is intended to interfere with ORS
659A.200 to
659A.224 describing the
circumstances applicable to disclosures by the Department's
workforce.
Notes
Stat. Auth.: ORS 409.050
Stats. Implemented: ORS 409.010 & 433.045
State regulations are updated quarterly; we currently have two versions available. Below is a comparison between our most recent version and the prior quarterly release. More comparison features will be added as we have more versions to compare.
No prior version found.