Or. Admin. Code § 411-045-0100 - Confidentiality and Reporting

(1) The PACE program must have policies and procedures that ensure maintenance of a clinical record keeping system that is consistent with state and federal regulations to which the PACE program is subject.

(2) Access to clinical records:

(a) Provider Access to clinical records:

(A) PACE programs will release health service information requested by a provider involved in the care of a PACE participant within ten working days of receiving a signed release;

(B) PACE programs will assure that health service providers have access to the applicable contents of a PACE participant's mental health records when necessary for use in the diagnosis or treatment of the participant. Such access is permitted under ORS 179.505;

(b) PACE Participant Access to Records: Except as provided in ORS 179.505(9), the PACE program will, upon request, provide the participant access to his or her own clinical record and provide copies within ten working days of the request. The PACE program may charge the PACE participant for reasonable duplication costs;

(c) Third Party Access to Records: Except as otherwise provided in this rule, the PACE program will upon written consent of the PACE participant, or his or her legal guardian, provide access to participant's clinical record. The PACE program may charge for reasonable duplication costs.

(3) Confidentiality:

(a) PACE programs must have written policies and procedures to ensure that clinical records related to participants receiving services are kept confidential in accordance with ORS 179.505-179.507, 411.320, 433.045(3), 42 CFR Part 2, 42 CFR Part 431, subpart F, 45 CFR 205.50. If the PACE program is a public body within the meaning of the Oregon public records law, such policies and procedures will ensure that PACE participant's privacy is maintained in accordance with 192.502(2), 192.502(8) (Confidential under Oregon law) and 192.502(9) (Confidential under Federal law) or other relevant public record exemptions.

(b) The PACE program staff and their providers must not release or disclose any information concerning a PACE participant to anyone other than the PACE participant or the participant's guardian for any purpose not directly connected with the administration of the Medicare program for Medicare recipients or of Title XIX of the Social Security Act for Medicaid recipients except as directed by the PACE participant;

(c) Except in an emergency, PACE program providers must obtain a written consent from the PACE participant or the legal guardian, or the legal Power of Attorney for health care decisions of the PACE participant before releasing information. The written consent, e.g., the DHR 2098 and 2099, will specify the type of information to be released and the recipient of the information, and a copy of the consent form will be placed in the PACE participants clinical record. In an emergency, release of service information will be limited to the extent necessary to meet the emergency information needs and then only to those persons involved in providing emergency medical services to the PACE participant.

(d) The PACE program staff and it agents, employees and subcontractors must protect the PACE participant's individually identifiable health information obtained or maintained from unauthorized use or disclosure consistent with the requirements in the Health Insurance Portability and Accountability Act or the federal regulations implementing the Act (collectively referred to as HIPAA).

(4) Mandatory Reporters: Employees of a PACE program have a responsibility and legal obligation to observe, detect and report to Adult Protective Services any signs or presence of abuse or neglect. The identity of the person reporting suspected abuse is confidential. Identity of the reporting person may be disclosed with the consent of that person, by judicial process or as required to perform the investigation by a law enforcement agency.

Notes

Or. Admin. Code § 411-045-0100

SDSD 5-2000, f. 12-29-00 cert. ef. 1-1-01; SPD 2-2005, f. & cert. ef. 1-4-05

Stat. Auth.: ORS 410.090

Stats. Implemented: ORS 410.070