Or. Admin. Code § 836-080-0665 - Authorization

(1) Except as provided in OAR 836-080-0670 and 836-080-0675, a licensee or insurance-support organization may not disclose any personal or privileged information about an individual collected or received in connection with an insurance transaction unless the disclosure is with the written authorization of the individual, and:

(a) If the authorization is submitted by another licensee or insurance-support organization, the authorization meets the requirements of this rule; or

(b) If the authorization is submitted by a person other than a licensee or insurance-support organization, the authorization is:

(A) Dated;

(B) Signed by the individual; and

(C) Obtained one year or less prior to the date a disclosure is sought pursuant to this subsection.

(2) A licensee or insurance-support organization may not use as its disclosure authorization form in connection with health insurance transactions a form or statement that authorizes the disclosure of personal or privileged information about an individual to the licensee or insurance-support organization unless the form or statement is clear and conspicuous, and contains all of the following:

(a) The identity of the individual who is the subject of the personal information.

(b) A general description of the categories of personal information to be disclosed.

(c) The signature of the individual who is the subject of the personal information or the individual who is legally empowered to grant authority and the date signed.

(3) An authorization may not remain valid for more than 24 months.

(4) An individual who is the subject of personal information may revoke an authorization provided pursuant to this rule at any time, subject to the rights of any individual who acted in reliance on the authorization prior to notice of the revocation.

(5) A licensee shall retain the authorization of an individual or a copy thereof in the record of the individual who is the subject of the personal information.

(6) This rule does not authorize the disclosure of personal or privileged information that is also individually identifiable health information when disclosure of the individually identifiable health information is prohibited or is otherwise regulated under the federal Health Insurance Portability and Accountability Act of 1996 (P.L. 104-191).

(7) A licensee is not required to comply with this rule with respect to a disclosure of personal information for which the licensee has obtained an authorization under the federal Health Insurance Portability and Accountability Act of 1996 (P.L. 104-191).

Notes

Or. Admin. Code § 836-080-0665

ID 4-2005, f. & cert. ef. 4-1-05

Stat. Auth.: ORS 731.244 & 746.608

Stats. Implemented: ORS 746.600 & 746.607