Or. Admin. Code § 411-020-0123 - Accessing Protected Health Information, including Records

Protected health information from a health care provider may be obtained during an APS investigation either from a mandatory reporter performing that reporter's duties required by Oregon statute or as follows:

(1) DISCLOSURE BY HEALTH CARE PROVIDER. A health care provider may disclose, in accordance with 45 CFR 164.512(j), protected health information to APS to prevent or lessen a serious and imminent threat to the health or safety of a person or the public if the health care provider, in good faith, believes the disclosure is necessary to prevent or lessen the threat. APS may request protected health information during a self-neglect or abuse investigation under this provision to prevent or lessen a serious and imminent threat.

(2) COMMUNITY ABUSE INVESTIGATION. During an APS investigation into abuse in a community-based setting where the process under section (1) of this rule does not apply or is declined by the health care provider:

(a) CONSENT BY ALLEGED VICTIM. APS may obtain an alleged victim's protected health information for an APS investigation with the alleged victim's consent.

(b) DECLINED CONSENT. If an alleged victim can make an informed choice and declines to consent to APS obtaining protected health information, APS may not obtain the alleged victim's protected health information beyond the information a mandatory reporter is required to disclose.

(c) ALLEGED VICTIM INCAPABLE OF CONSENT. If an alleged victim is an older adult and does not have the ability to make an informed choice to consent to APS obtaining the alleged victim's protected health information, and the alleged victim does not have a fiduciary or legal representative that consents to APS accessing the alleged victim's protected health information, or when the fiduciary or legal representative is an alleged perpetrator and refuses to consent to APS accessing the alleged victim's protected health information, then the following procedure must be followed in order for APS to obtain the protected health information:

(A) APS must request that the appropriate law enforcement agency submit a written request to the health care provider to allow the law enforcement agency to inspect and copy, or otherwise obtain, the protected health information.

(B) APS shall inform the law enforcement agency that the written request must state that an investigation into abuse is being conducted under ORS 124.070 (elder abuse) or ORS 441.650 (nursing facility resident abuse).

(3) HEALTH CARE PROVIDER NOTICE. In investigations where APS is seeking disclosure of protected health information by a health care provider under sections (1) or (2) of this rule, APS shall inform the health care provider, either directly or through the law enforcement agency requesting the information, that the health care provider is required, in accordance with 45 CFR 164.512(c)(2), to promptly inform the individual to whom the protected health information pertains that information has been or shall be disclosed, unless:

(a) The health care provider, in the exercise of their professional judgment, believes that informing the individual may place the individual at risk of serious harm; or

(b) The health care provider is planning to inform a personal representative of the individual and the health care provider reasonably believes the personal representative is responsible for the abuse, neglect, or other injury, and informing such person is not in the best interests of the individual as determined by the health care provider in the exercise of their professional judgment.

(4) LICENSED CARE FACILITY INVESTIGATIONS. During an APS investigation into abuse in a licensed care facility:

(a) OBTAINING RESIDENT RECORDS MAINTAINED BY A LICENSED CARE FACILITY. Licensed care facilities must provide DHS access to all resident and facility records, including protected health information, maintained by the facility as required by their respective Oregon Administrative Rules.

(b) DISCLOSURE BY HEALTH CARE PROVIDER. A health care provider, such as a hospital, a medical office, or a provider other than a licensed care facility, may disclose, in accordance with 45 CFR 164.512(d), an alleged victim's protected health information to APS as a health oversight agency for purposes of oversight of that facility, including oversight through investigation of reports of abuse of residents in such facility. APS shall inform the health care provider of its authority as a health oversight agency and that such disclosures are permitted in accordance with 45 CFR 164.512(d).

(c) HEALTH CARE PROVIDER REFUSAL TO DISCLOSE. If a health care provider refuses to disclose protected health information to APS as a health oversight agency, APS may follow the procedure set forth in section (2)(c) of this rule if the alleged victim is an older adult.

Notes

Or. Admin. Code § 411-020-0123

SPD 7-2012(Temp), f. & cert. ef. 6-1-12 thru 11-28-12; SPD 15-2012, f. & cert. ef. 11-28-12; APD 37-2014, f. 11-24-14, cert. ef. 1/1/2015; APD 16-2018, temporary amend filed 06/28/2018, effective 07/01/2018 through 12/27/2018; APD 44-2018, amend filed 12/27/2018, effective 12/27/2018

Statutory/Other Authority: ORS 124.055, 124.065, 124.070, 409.010, 410.020, 410.040, 410.070 & ORS 411.060, 411.116, 443.450, 443.765, 443.767, 45 CFR 164.512(j)

Statutes/Other Implemented: ORS 124.050 - 124.095, 409.010, 410.020, 410.040, 410.070, 411.116, 443.450 & 443.500, 443.767, Oregon Laws 2012 Chapter 70, 45 CFR 164.512(j)