Or. Admin. Code § 943-014-0030 - Client Privacy Rights
(1) Rights of clients to access
their information. Clients may access, inspect, and obtain a copy of
information on their own cases in Authority files or records,
consistent with federal and state law.
(a) A client may request access by
completing the Access to Records Request form, or by providing
sufficient information to accomplish this request.
(b) Clients may request access to
their own information that is kept by the Authority by using a
personal identifier such as the client's name or Authority case
number.
(c) If the
Authority maintains information in a record that includes information
about other people, the client may see information only about himself
or herself.
(d) If a
person identified in the file is a minor child of the client, and the
client is authorized under Oregon law to have access to the minor's
information or to act on behalf of the minor for making decisions
about the minor's care, the client may obtain information about the
minor.
(e) If the
requestor of information is recognized under Oregon law as a the
client's guardian or custodian and is authorized under Oregon law to
have access to the client's information or to act on behalf of the
client for making decisions about the client's services or care, the
Authority shall release information to the requestor.
(f) For individuals with
disabilities or mental illnesses, the named system in ORS
192.517, to protect
and advocate the rights of individuals with developmental
disabilities under Part C of the Developmental Disabilities
Assistance and Bill of Rights Act (42 U.S.C. 6041
et seq.) and the rights of individuals with mental illness under the
Protection and Advocacy for Individuals with Mental Illness Act (42 U.S.C.
10801 et seq.), shall have access
to all records defined in ORS
192.515.
(g) The Authority may deny a
client's access to their own PHI if federal law prohibits the
disclosure. Clients may access, inspect, and obtain a copy of health
information on their own case in Authority files or records except
for the following:
(A) Psychotherapy
notes;
(B) Information
compiled in reasonable anticipation of, or for use in civil,
criminal, or administrative proceedings;
(C) Information that is subject to
the federal Clinical Labs Improvement Amendments of 1988, or exempt
pursuant to
42 CFR
493.3(a)(2);
(D) Information that the Authority
believes, in good faith, can cause harm to the client, participant,
or to any other person; and
(E) Documents protected by attorney
work-product privilege.
(h) The Authority may deny a client
access to information that was obtained under a promise of
confidentiality from a person other than a health care provider to
the extent that access would reveal the source of the
information.
(i) The
Authority may deny a client access to information, if the Authority
gives the client a right to have the denial reviewed when:
(A) A licensed health care
professional (for health information) or other designated staff (for
other information) has determined, in the exercise of professional
judgment, that the information requested may endanger the life or
physical safety of the client or another person;
(B) The information makes reference
to another person, and a licensed health care professional (for
health information) or other designated staff (for other information)
has determined, in the exercise of professional judgment, that the
information requested may cause substantial harm to the client or to
another person; or
(C)
The request for access is made by the client's personal
representative, and a licensed health care professional (for health
information) or other designated staff (for other information) has
determined, in the exercise of professional judgment, that allowing
the personal representative access to the information may cause
substantial harm to the client or to another person.
(j) If the Authority
denies access under section (1)(i) of this rule, the client may have
the decision reviewed by a licensed health care professional (for
health information) or other designated staff (for other information)
not directly involved in making the original denial decision.
(A) The Authority must promptly
refer a client's request for review to the designated
reviewer.
(B) The
reviewer must determine, within the 30 or 60-day time limits stated
in section (1)(k)(A) and (B) of this rule, whether to approve or deny
the client's request for access.
(C) Based on the reviewer's
decision, the Authority shall:
(i)
Promptly notify the client in writing of the reviewer's
determination; and
(ii)
If approved, take action to carry out the reviewer's
determination.
(k) The Authority must act on a
client's request for access no later than 30 days after receiving the
request, except as provided in this section and in the case of
written accounts under ORS
179.505, which must be
disclosed within five days.
(A) In
cases where the information is not maintained or accessible to the
Authority on-site, and does not fall under ORS
179.505, the Authority
must act on the client's request no later than 60 days after
receiving the request.
(B) If the Authority is unable to
act within the 30 or 60-day limits, the Authority may extend this
time period a maximum of 30 additional days, subject to the
following:
(i) The Authority must
notify the client in writing of the reasons for the delay and the
date by which the Authority shall act on the request.
(ii) The Authority shall use only
one 30-day extension.
(l) If the Authority grants the
client's request, in whole or in part, the Authority must inform the
client of the access decision and provide the requested access.
(A) If the Authority maintains the
same information in more than one format or at more than one
location, the Authority may provide the requested information
once.
(B) The Authority
must provide the requested information in a form or format requested
by the client, if readily producible in that form or format. If not
readily producible, the Authority shall provide the information in a
readable hard-copy format or other format as agreed to by the
Authority and the client.
(C) The Authority may provide the
client with a summary of the requested information, in lieu of
providing access, or may provide an explanation of the information if
access has been provided, if:
(i)
The client agrees in advance; and
(ii) The client agrees in advance
to pay any fees the Authority may impose, under section (1)(L)(E) of
this rule.
(D)
The Authority shall arrange with the client for providing the
requested access in a time, place, and manner convenient for the
client and the Authority.
(E) If a client, or legal guardian
or custodian, requests a copy, written summary, or explanation of the
requested information, the Authority may impose a reasonable
cost-based fee, limited to the following:
(i) Copying the requested
information, including the costs of supplies and the labor of
copying;
(ii) Postage;
and
(iii) Staff time for
preparing an explanation or summary of the requested
information.
(m) If the Authority denies access,
in whole or in part, to the requested information, the Authority
must:
(A) Give the client access to
any other requested client information, after excluding the
information to which access is denied; and
(B) Provide the client with a
timely written denial. The denial must:
(i) Be provided within the time
limits specified in section (1)(k)(A) and (B) of this rule;
(ii) State the basis of the denial
in plain language;
(iii)
If the Authority denies access under section (1)(i) of this rule,
explain the client's review rights as specified in section (1)(j) of
this rule, including an explanation of how the client may exercise
these rights; and
(iv)
Provide a description of how the client may file a complaint with the
Authority, and if the information is PHI, with the United States
Department of Health and Human Services (DHHS), Office for Civil
Rights, pursuant to section (7) of this rule.
(n) If the Authority
does not maintain the requested information, in whole or in part, and
knows where the information is maintained (such as by a medical
provider, insurer, other public agency, private business, or other
non-Authority entity), the Authority must inform the client where to
direct the request for access.
(2) Authority Notice of Privacy
Practices. The Authority shall send clients notice about the
Authority's privacy practices as follows:
(a) The Authority shall make
available to each client a notice of Authority privacy practices that
describes the duty of the Authority to maintain the privacy of PHI
and include a description that clearly informs the client of the
types of uses and disclosures the Authority is permitted or required
to make;
(b) The
Authority shall provide all clients in direct care settings a notice
of Authority privacy practices and shall request the client's
signature on an acknowledgement of receipt form;
(c) If the Authority revises its
privacy practices, the Authority shall make the revised notice
available to all clients;
(d) The Authority shall post a copy
of the Authority's Notice of Privacy Practices for public viewing at
each Authority worksite and on the Authority website; and
(e) The Authority shall give a
paper copy of the Authority's Notice of Privacy Practices to any
individual upon request.
(3) Right to request restrictions
on uses or disclosures. Clients may request restrictions on the use
or disclosure of their information.
(a) The Authority may deny the
client's request or limit its agreement to a request.
(A) The Authority may not agree to
restrict uses or disclosures of information if the restriction would
adversely affect the quality of the client's care or
services.
(B) The
Authority may not agree to restrict uses or disclosures of
information that would limit or prevent the Authority from making or
obtaining payment for services.
(b) The Authority may not deny a
client's request to restrict the sharing of records of alcohol and
drug treatment or records relating to vocational rehabilitation
services with another Authority program.
(c) The Authority shall document
the client's request, and the reasons for granting or denying the
request, in the client's Authority case file.
(d) If the client needs emergency
treatment and the restricted protected information is needed to
provide the treatment, the Authority may use or disclose the
restricted protected information to a provider, for the limited
purpose of providing treatment. However, once the emergency situation
subsides the Authority shall ask the provider not to redisclose the
information.
(e) The
Authority may terminate its agreement to a restriction if:
(A) The client agrees to or
requests the termination in writing;
(B) The client orally requests or
agrees to the termination, and the Authority documents the oral
request or agreement in the client's Authority case file;
or
(C) With or without
the client's agreement, the Authority informs the client that the
Authority is terminating its agreement to the restriction.
Information created or received while the restriction was in place
shall remain subject to the restriction.
(4) Rights of clients to
request to receive information from the Authority by alternative
means or at alternative locations. The Authority must accommodate
reasonable requests by clients to receive communications from the
Authority by alternative means, such as by mail, e-mail, fax, or
telephone, and at an alternative location.
(a) The client must specify the
preferred alternative means or location.
(b) The client may submit the
request for alternative means or locations either orally or in
writing.
(A) If the client makes a
request in-person, the Authority shall document the request and ask
for the client's signature.
(B) If the client makes a request
by telephone or electronically, the Authority shall document the
request and verify the identity of the client.
(c) The Authority may terminate its
agreement to an alternative location or method of communication if:
(A) The client agrees to or
requests termination of the alternative location or method of
communication in writing or orally. The Authority shall document the
oral agreement or request in the client's Authority case file;
or
(B) The Authority
informs the client that the Authority is terminating its agreement to
the alternative location or method of communication because the
alternative location or method of communication is not effective. The
Authority may terminate its agreement to communicate at the
alternative location or by the alternate method if:
(i) The Authority is unable to
contact the client at the location or by the method requested;
or
(ii) The client fails
to respond to payment requests, if applicable.
(5) Right of
clients to request amendment of their information. Clients may
request that the Authority amend information about themselves in
Authority files.
(a) For all
amendment requests, the Authority shall have the client complete the
approved Authority form.
(b) The Authority may deny the
request or limit its agreement to amend.
(c) The Authority must act on the
client's request no later than 60 days after receiving the request.
If the Authority is unable to act within 60 days, the Authority may
extend this time limit by a maximum of 30 additional days, subject to
the following:
(A) The Authority
must notify the client in writing, within 60 days of receiving the
request, of the reasons for the delay and the date by which the
Authority shall act on the request; and
(B) The Authority shall use only
one 30-day extension.
(d) The program's medical director,
a licensed health care professional designated by the program
administrator, or an Authority staff person involved in the client's
case must review the request and any related documentation prior to
making a decision to amend a health or medical record.
(e) A staff person designated by
the Authority shall review the request and any related documentation
prior to making a decision to amend any information that is not a
health or medical record.
(f) If the Authority grants the
request, in whole or in part, the Authority shall:
(A) Make the appropriate amendment
to the information or records, and document the amendment in the
client's Authority file or record;
(B) Provide notice to the client
that the amendment has been granted, pursuant to the time limits
under section (5)(c) of this rule;
(C) Obtain the client's agreement
to notify other relevant persons or entities with whom the Authority
has shared or needs to share the amended information; and
(D) Inform and provide the
amendment within a reasonable time to:
(i) Persons named by the client who
have received the information and who need the amendment;
and
(ii) Persons,
including business associates of the Authority, that the Authority
knows have the information that is the subject of the amendment and
who may have relied, or could foreseeably rely, on the information to
the client's detriment.
(g) The Authority may deny the
client's request for amendment if:
(A) The Authority finds the
information to be accurate and complete;
(B) The information was not created
by the Authority;
(C) The
information is not part of Authority records; or
(D) The information would not be
available for inspection or access by the client, pursuant to section
(1)(g) and (h) of this rule.
(h) If the Authority denies the
amendment request, in whole or in part, the Authority must provide
the client with a written denial. The denial must:
(A) Be sent within the time limits
specified in section (5)(c) of this rule;
(B) State the basis for the denial,
in plain language; and
(C) Explain the client's right to
submit a written statement disagreeing with the denial and how to
file the statement. If the client files a statement:
(i) The Authority shall enter the
written statement into the client's Authority case file;
(ii) The Authority may also enter
an Authority written rebuttal of the client's written statement into
the client's Authority case file. The Authority shall send a copy of
any written rebuttal to the client;
(iii) The Authority shall include a
copy of the statement and any Authority written rebuttal with any
future disclosures of the relevant information;
(iv) If a client does not submit a
written statement of disagreement, the client may ask that if the
Authority makes any further disclosures of the relevant information
that the Authority shall also include a copy of the client's original
request for amendment and a copy of the Authority written denial;
and
(v) The Authority
shall provide information on how the client may file a complaint with
the Authority and, if the information is PHI, with DHHS, Office for
Civil Rights.
(6) Rights of clients to request an
accounting of disclosures of PHI. Clients may receive an accounting
of disclosures of PHI that the Authority has made for any period of
time, not to exceed six years, preceding the request date for the
accounting.
(a) For all requests
for an accounting of disclosures, the client may complete the
authorized Authority form "Request for Accounting of Disclosures of
Health Records", or provide sufficient information to accomplish this
request.
(b) The right to
an accounting of disclosures does not apply when the request is:
(A) Authorized by the
client;
(B) Made prior to
April 14, 2003;
(C) Made
to carry out treatment, payment, or health care operations, unless
these disclosures are made from an electronic health
record;
(D) Made to the
client;
(E) Made to
persons involved in the client's care;
(F) Made as part of a limited data
set in accordance with OAR 943-014-0070;
(G) Made for national security or
intelligence purposes; or
(H) Made to correctional
institutions or law enforcement officials having lawful custody of an
inmate.
(c)
For each disclosure, the accounting must include:
(A) The date of the
disclosure;
(B) The name
and address, if known, of the person or entit, who received the
disclosed information;
(C) A brief description of the
information disclosed; and
(D) A brief statement of the
purpose of the disclosure that reasonably informs the client of the
basis for the disclosure, or, in lieu of a statement, a copy of the
client's written request for a disclosure, if any.
(d) If, during the time
period covered by the accounting, the Authority has made multiple
disclosures to the same person or entity for the same purpose, the
Authority may provide the required information for only the first
disclosure. The Authority need not list the same identical
information for each subsequent disclosure to the same person or
entity if the Authority adds the following information:
(A) The frequency or number of
disclosures made to the same person or entity; and
(B) The date of the most recent
disclosure during the time period for which the accounting is
requested.
(e)
The Authority must act on the client's request for an accounting no
later than 60 days after receiving the request. If the Authority is
unable to act within 60 days, the Authority may extend this time
limit by a maximum of 30 additional days, subject to the following:
(A) The Authority must notify the
client in writing, within 60 days of receiving the request, of the
reasons for the delay and the date by which the Authority shall act
on the request; and
(B)
The Authority shall use only one 30-day extension.
(f) The Authority shall
provide the first requested accounting in any 12-month period without
charge. The Authority may charge the client a reasonable cost-based
fee for each additional accounting requested by the client within the
12-month period following the first request, if the Authority:
(A) Informs the client of the fee
before proceeding with any additional request; and
(B) Allows the client an
opportunity to withdraw or modify the request in order to avoid or
reduce the fee.
(g) The Authority shall document
the information required to be included in an accounting of
disclosures, as specified in section (6)(c) of this rule, and retain
a copy of the written accounting provided to the client.
(h) The Authority shall temporarily
suspend a client's right to receive an accounting of disclosures that
the Authority has made to a health oversight agency or to a law
enforcement official, for a length of time specified by the agency or
official, if the agency or official provides a written or oral
statement to the Authority that the accounting would be reasonably
likely to impede their activities. If the agency or official makes an
oral request, the Authority shall:
(A) Document the oral request,
including the identity of the agency or official making the
request.
(B) Temporarily
suspend the client's request to an accounting of disclosures;
and
(C) Limit the
temporary suspension to no longer than 30 days from the date of the
oral request, unless the agency or official submits a written request
specifying a longer time period.
(7) Filing a complaint. Clients may
file a complaint with the Authority or, if the information is PHI,
with DHHS, Office for Civil Rights.
(a) Upon request, the Authority
shall give clients the name and address of the specific person or
office of where to submit complaints to DHHS.
(b) The Authority may not
intimidate, threaten, coerce, discriminate against, or take any other
form of retaliatory action against any individual filing a complaint
or inquiring about how to file a complaint.
(c) The Authority may not require
clients to waive their rights to file a complaint as a condition of
providing treatment, payment, enrollment in a health plan, or
eligibility for benefits.
(d) The Authority shall designate
staff to review and determine action on complaints filed with the
Authority.
(e) The
Authority shall document, in the client's Authority case file all
complaints, the findings from reviewing each complaint, and the
Authority's actions resulting from the complaint. For each complaint
the documentation shall include a description of corrective action
that the Authority has taken, if any are necessary, or why corrective
action is not needed.
Notes
Stat. Auth.: ORS 413.042
Stats. Implemented: ORS 179.505, 192.518 - 192.529, 411.010, 413.032 & 414.065
State regulations are updated quarterly; we currently have two versions available. Below is a comparison between our most recent version and the prior quarterly release. More comparison features will be added as we have more versions to compare.
No prior version found.