OAR 333-333-4900: Collection and Maintenance of 303 Client Data

(1) On and after January 1, 2025, service centers must collect 303 client data in a manner prescribed by the Oregon Health Authority (Authority), consistent with OAR chapter 950, division 30, by using the form published by the Authority on its website prior to beginning an administration session for every client who will participate in an administration session at the licensed premises. (2) Service centers, including licensee representatives described in section (3) of this rule, must store, maintain and destroy 303 client data, including 303 client data that is not reported to the Authority pursuant to OAR 333-333-4910, in a manner that prevents unauthorized access and protects client confidentiality. (3) 303 client data may only be accessed by licensees and licensee representatives of a service center. Service centers may enter into agreements with individuals and organizations to act as licensee representatives for the purpose of collecting, reporting, storing, maintaining and destroying 303 client data. (4) If a service center enters an agreement described in section (3) of this rule, the service center must provide notice to clients, and 303 client data must be stored at the service center or on cloud-based platforms as described OAR 333-333-4820. (5) Prior to beginning an administration session, every client must provide written confirmation, in a form and manner prescribed by the Authority, that the client has had an opportunity to request that 303 client data related to their receipt of psilocybin services be withheld from data submitted to the Authority. (6) A service center must collect 303 client data by using the form described in section (1) from every client, even if a client requests their information be withheld from data submitted to the Authority. (7) Licensee representatives and facilitators are prohibited from encouraging clients to request that their data be withheld from data submitted to the Authority or otherwise influencing a client’s responses to the form described in section (1) of this rule. (8) Failure to comply with this rule is a violation.