Or. Admin. Code § 407-120-0160 - Conduct of Transactions - EDI Transactions
(1) EDI Submitter Obligations. An EDI
submitter is responsible for the conduct of the EDI transactions registered on
behalf of a trading partner, including the following:
(a) EDI Transmission Accuracy. An EDI
submitter shall take reasonable care to ensure that data and data transmissions
are timely, complete, accurate, and secure; and shall take reasonable
precautions to prevent unauthorized access to the information system, the data
transmission, or the contents of an envelope which is transmitted either to or
from the Department. The Department will not correct or modify an incorrect
transaction prior to processing. The transaction may be rejected and an EDI
submitter notified of the rejection.
(b) Re-transmission of Indecipherable
Transmissions. Where there is evidence that a data transmission is lost or
indecipherable, the sending party must make best efforts to trace and
re-transmit the original data transmission in a manner which allows it to be
processed by the receiving party as soon as practicable.
(c) Cost of Equipment. An EDI submitter and
the Department will pay for their own information system costs. An EDI
submitter shall, at its own expense, obtain and maintain its own information
system. An EDI submitter shall pay its own costs for all charges related to
data transmission including, without limitation, charges for information system
equipment, software and services, electronic mailbox maintenance, connect time,
terminals, connections, telephones, modems, any applicable minimum use charges,
and for translating, formatting, sending, and receiving communications over the
electronic network to the electronic mailbox, if any, of the Department. The
Department is not responsible for providing technical assistance in the
processing of an EDI transaction.
(d) Back-up Files. EDI submitters must
maintain adequate data archives and back-up files or other means sufficient to
re-create a data transmission in the event that re-creation becomes necessary
for any purpose, within timeframes required by state and federal law, or by
contractual agreement. Data archives or back-up files shall be subject to these
rules to the same extent as the original data transmission.
(e) Transmissions Format. Except as otherwise
provided herein, EDI submitters must send and receive all data transmissions in
the federally mandated format, or (if no federal standard has been promulgated)
other formats as the Department designates.
(f) Testing. EDI submitters must, prior to
the initial data transmission and throughout the term of a TPA, test and
cooperate with the Department in the testing of information systems as the
Department considers reasonably necessary to ensure the accuracy, timeliness,
completeness, and confidentiality of each data transmission.
(2) Security and Confidentiality.
To protect security and confidentiality of transmitted data, EDI submitters
must comply with the following:
(a) Refrain
from copying, reverse engineering, disclosing, publishing, distributing, or
altering any data, data transmissions, or the contents of an envelope, except
as necessary to comply with the terms of these rules or the TPA, or use the
same for any purpose other than that which an EDI submitter was specifically
given access and authorization by the Department or a trading
partner;
(b) Refrain from obtaining
access by any means to any data, data transmission, envelope, mailbox, or the
Department's information system for any purpose other than that which an EDI
submitter has received express authorization. If an EDI submitter receives data
or data transmissions from the Department which clearly are not intended for an
EDI submitter, an EDI submitter shall immediately notify the Department and
make arrangements to return or re-transmit the data or data transmission to the
Department. After re-transmission, an EDI submitter shall immediately delete
the data contained in the data transmission from its information
system;
(c) Install necessary
security precautions to ensure the security of the information systems or
records relating to the information systems of either the Department or an EDI
submitter when the information system is not in active use by an EDI
submitter;
(d) Protect and maintain
the confidentiality of security access codes issued by the Department to an EDI
submitter; and
(e) Provide special
protection for security and other purposes, where appropriate, by means of
authentication, encryption, the use of passwords, or other means. Unless
otherwise provided in these rules, the recipient of a protected data
transmission must at least use the same level of protection for any subsequent
transmission of the original data transmission.
(3) Department Obligations. The Department
shall:
(a) Make available to an EDI submitter,
by electronic media, those types of data and data transmissions which an EDI
submitter is authorized to receive.
(b) Inform an EDI submitter of acceptable
formats in which data transmissions may be made and provide notification to an
EDI submitter within reasonable time periods consistent with HIPAA transaction
standards, if applicable, or at least 30 days prior by electronic notice of
other changes in formats.
(c)
Provide an EDI submitter with security access codes that will allow an EDI
submitter access to the Department's information system. Security access codes
are strictly confidential and EDI submitters must comply with all of the
requirements of OAR 407-120-0170. The Department may
change the designated security access codes at any time and manner as the
Department, in its sole discretion, deems necessary. The release of security
access codes shall be limited to authorized electronic data personnel of an EDI
submitter and the Department with a need to know.
Notes
Stat. Auth.: ORS 409.050, 414.065
Stats. Implemented: ORS 414.065
State regulations are updated quarterly; we currently have two versions available. Below is a comparison between our most recent version and the prior quarterly release. More comparison features will be added as we have more versions to compare.
No prior version found.