OAR 407-014-0020: Uses and Disclosures of Client or Participant Protected Information

(1) Uses and disclosures with individual authorization. The Department must obtain a completed and signed authorization for release of information from the individual, or the individual’s personal representative, before obtaining or using protected information about an individual from a third party or disclosing protected information about the individual to a third party. (a) Uses and disclosures must be consistent with what the individual has approved on the signed authorization form approved by the Department. (b) An individual may revoke an authorization at any time. The revocation must be in writing and signed by the individual, except that substance abuse treatment patients may orally revoke an authorization to disclose information obtained from substance abuse treatment programs. No revocation shall apply to information already released while the authorization was valid and in effect. (2) Uses and disclosures without authorization. The Department may use and disclose information without written authorization in the following circumstances: (a) The Department may disclose information to individuals who have requested disclosure to themselves of their information, if the individual has the right to access the information under OAR 407-014-0030(6). (b) If the law requires or permits the disclosure, and the use and disclosure complies with, and is limited to, the relevant requirements of the relevant law. (c) For treatment, payment, and health care operations, the Department may disclose the following information: (A) Activities involving the current treatment of an individual, for the Department or health care provider; (B) Payment activities, for the Department, covered entity, or health care provider; (C) Protected health information for the purpose of health care operations; and (D) Substance abuse treatment information, if the recipient has a Qualified Service Organization Agreement with the Department. (d) Psychotherapy notes. The Department may only use and disclose psychotherapy notes in the following circumstances: (A) In the Department’s supervised counseling training programs; (B) In connection with oversight of the originator of the psychotherapy notes; or (C) To defend the Department in a legal action or other proceeding brought by the individual. (e) Public health activities. (A) The Department may disclose an individual’s protected information to appropriate entities or persons for governmental public health activities and for other purposes including but not limited to: (i) A governmental public health authority that is authorized by law to collect or receive protected information for the purpose of preventing or controlling disease, injury, or disability, including but not limited to reporting disease, injury, and vital events such as birth or death, and conducting public health surveillance, investigations, and interventions; (ii) An official of a foreign government agency that is acting in collaboration with a governmental public health authority; (iii) A governmental public health authority, or other government authority that is authorized by law to receive reports of child abuse or neglect; (iv) A person subject to the jurisdiction of the federal Food and Drug Administration (FDA), regarding an FDA-regulated product or activity for which that person is responsible for activities related to the quality, safety, or effectiveness of an FDA-regulated product or activity; or (v) A person who may have been exposed to a communicable disease, or may be at risk of contracting or spreading a disease or condition. (B) Where state or federal law prohibits or restricts use and disclosure of information obtained or maintained for public health purposes, the Department shall deny the use and disclosure. (f) Child abuse reporting and investigation. If the Department has reasonable cause to believe that a child is a victim of abuse or neglect, the Department may disclose protected information to appropriate governmental authorities authorized by law to receive reports of child abuse or neglect (including reporting to the Department protective services staff if appropriate). If the Department receives information as the child protective services agency, the Department may use and disclose the information consistent with its legal authority and in compliance with any applicable state and federal regulations. (g) Adult abuse reporting and investigation. If the Department has reasonable cause to believe that a vulnerable adult is a victim of abuse or neglect, the Department may disclose information, as required by law, to a government authority or regulatory agency authorized by law to receive reports of abuse or neglect including but not limited to a social service or protective services agency (which may include the Department) authorized by law to receive such reports. Vulnerable adults are adults age 65 or older and persons with disabilities. If the Department receives information as the social services or protective services agency, the Department may use and disclose the information. (h) Health oversight activities. The Department may disclose information without authorization for health oversight activities including audits; civil, criminal, or administrative investigations, prosecutions, licensing or disciplinary actions; Medicaid fraud; or other necessary oversight activities. (i) Administrative and court hearings, grievances, investigations, and appeals. (A) The Department may use or disclose information for an investigation, administrative or court hearing, grievance, or appeal about an individual’s eligibility or right to receive Department benefits or services. (B) If the Department has obtained information in performing its duties as a health oversight agency, protective service entity, or public benefit program, the Department may use or disclose that information in an administrative or court hearing consistent with the other privacy requirements applicable to that program, service, or activity. (j) Court orders. The Department may disclose information for judicial or administrative proceedings in response to a court order, subpoena, discovery request, or other legal process. If a court orders the Department to conduct a mental examination pursuant to ORS 161.315, 161.365, 161.370, or 419B.352, or orders the Department to provide any other report or evaluation to the court, the examination, report, or evaluation shall be deemed to be required by law for purposes of HIPAA. (k) Law enforcement purposes. For limited law enforcement purposes, the Department may report certain injuries or wounds; provide information to identify or locate a suspect, victim, or witness; alert law enforcement of a death as a result of criminal conduct; and provide information which constitutes evidence of criminal conduct on Department premises. (A) The Department may provide client information to a law enforcement officer in any of the following situations: (i) The law enforcement officer is involved in carrying out any investigation, criminal, or civil proceedings connected with administering the program from which the information is sought; (ii) A Department employee may disclose information from personal knowledge that does not come from the client’s interaction with the Department; (iii) The disclosure is authorized by statute or administrative rule; (iv) The information informs law enforcement of a death as a result of criminal conduct; (v) The information constitutes evidence of criminal conduct on Department premises; or (vi) The disclosure is necessary to protect the client or others, and the client poses a threat to his or her safety or to the safety of others. (B) Except as provided in section (2)(k)(C) of this rule, the Department may give a client’s current address, Social Security number, and photo to a law enforcement officer if the law enforcement officer makes the request in the course of official duty, supplies the client’s name, and states that the client: (i) Is a fugitive felon or is violating parole, probation, or post-prison supervision; (ii) For all public assistance programs, has information that is necessary for the officer to conduct official duties, and the location or apprehension of the client is within the officer’s official duties; or (iii) For clients only in the SNAP program, has information that is necessary to conduct an official investigation of a fugitive felon or person violating parole, probation, or post-prison supervision. (C) If domestic violence has been identified in the household, the Department may not release information about a victim of domestic violence unless a member of the household is either wanted as a fugitive felon or is violating parole, probation, or post-prison supervision. (D) For purposes of this subsection, a fugitive felon is a person fleeing to avoid prosecution or custody for a crime, or an attempt to commit a crime, that would be classified as a felony. (E) For purposes of this section, a law enforcement officer is an employee of the Oregon State Police, a county sheriff’s department, or a municipal police department, whose official duties include arrest authority. (l) Use and disclosure of information about deceased individuals. (A) The Department may disclose individual information to a coroner or medical examiner for the purpose of identifying a deceased individual, determining cause of death, or other duties authorized by law. (B) The Department may disclose individual information to funeral directors as needed to carry out their duties regarding the decedent. The Department may also disclose individual information prior to, and in anticipation of, the death. (m) Organ or tissue donation. The Department may disclose individual information to organ procurement organizations or other entities engaged in procuring, banking, or transplanting cadaver organs, eyes, or tissue for the purpose of facilitating transplantation. (n) Research. The Department may disclose individual information without authorization for research purposes, as specified in OAR 407-014-0060. (o) Threat to health or safety. To avert a serious threat to health or safety the Department may disclose individual information if: (A) The Department believes in good faith that the information is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public; and (B) The report is to a person or persons reasonably able to prevent or lessen the threat, including the target of the threat. (p) National security and intelligence. The Department may disclose information to authorized federal officials for lawful intelligence, counterintelligence, and other national security activities. (q) Correctional institutions and law enforcement custody situations. The Department may disclose information to a correctional institution or a law enforcement official having lawful custody of an inmate or other person, for the limited purpose of providing health care or ensuring the health or safety of the person or other inmates. (r) Emergency treatment. In case of an emergency, the Department may disclose individual information to the extent needed to provide emergency treatment. (s) Government entities providing public benefits. The Department may disclose eligibility and other information to governmental entities administering a government program providing public benefits. (3) Authorization not required if opportunity to object given. The Department may use and disclose an individual’s information without authorization if the Department informs the individual in advance and gives the individual an opportunity to either agree or refuse or restrict the use and disclosure. (a) These disclosures are limited to disclosure of information to a family member, other relative, close personal friend of the individual, or any other person named by the individual, subject to the following limitations: (A) The Department may disclose only the protected information that directly relates to the person’s involvement with the individual’s care or payment for care. (B) The Department may use and disclose protected information for notifying, identifying, or locating a family member, personal representative, or other person responsible for care of the individual, regarding the individual’s location, general condition, or death. For individuals who had resided at one time at the state training center, OAR 411-320-0090(6) addresses family reconnection. (C) If the individual is present for, or available prior to, a use and disclosure, the Department may disclose the protected information if the Department: (i) Obtains the individual’s agreement; (ii) Provides the individual an opportunity to object to the disclosure, and the individual does not object; or (iii) Reasonably infers from the circumstances that the individual does not object to the disclosure. (D) If the individual is not present, or the opportunity to object to the use and disclosure cannot practicably be provided due to the individual’s incapacity or an emergency situation, the Department may disclose the information if, using professional judgment, the Department determines that the use and disclosure is in the individual’s best interests. (b) Exception. For individuals referred to or receiving substance abuse treatment, mental health, or vocational rehabilitation services, the Department shall not use or disclose information without written authorization, unless disclosure is otherwise permitted under 42 CFR part 2, 34 CFR 361.38, or ORS 179.505. (c) Personal representative. The Department must treat a personal representative as the individual for purposes of these rules, except that: (A) A personal representative must be authorized under state law to act on behalf of the individual with respect to use and disclosure of information. The Department may require a personal representative to provide a copy of the documentation authorizing the person to act on behalf of the individual. (B) The Department may elect not to treat a person as a personal representative of an individual if: (i) The Department has a reasonable belief that the individual has been or may be subjected to domestic violence, abuse, or neglect by the person; (ii) The Department, in the exercise of professional judgment, decides that it is not in the best interest of the individual to treat the person as the individual’s personal representative. (4) Redisclosure. The Department must inform the individual that information held by the Department and authorized by the individual for disclosure may be subject to redisclosure and no longer protected by these rules. (5) Specific written authorization. If the use or disclosure of information requires an authorization, the authorization must specify that the Department may use or disclose vocational rehabilitation records, alcohol and drug records, HIV/AIDS records, genetics information, and mental health or developmental disability records held by publicly funded providers. (a) Pursuant to federal regulations at 42 CFR part 2 and 34 CFR 361.38, the Department may not make further disclosure of vocational rehabilitation and alcohol and drug rehabilitation information without the specific written authorization of the individual to whom it pertains. (b) Pursuant to ORS 433.045 and OAR 333-012-0270, the Department may not make further disclosure of individual information pertaining to HIV/AIDS. (c) Pursuant to ORS 192.531 to 192.549, the Department may not make further disclosure pertaining to genetic information. (6) Verification of person or entity requesting information. The Department may not disclose information about an individual without first verifying the identity of the person or entity requesting the information, unless the Department workforce member fulfilling the request already knows the person or has already verified identity. (7) Whistleblowers. The Department may disclose an individual’s protected health information under the HIPAA privacy rules under the following circumstances: (a) The Department workforce member believes in good faith that the Department has engaged in conduct that is unlawful or that otherwise violates professional standards or Department policy, or that the care, services, or conditions provided by the Department could endanger Department staff, individuals in Department care, or the public; and (b) The disclosure is to a government oversight agency or public health authority, or an attorney of a Department workforce member retained for the purpose of determining the legal options of the workforce member with regard to the conduct alleged under section (7)(a) above; and (c) Nothing in this rule is intended to interfere with ORS 659A.200 to 659A.224 describing the circumstances applicable to disclosures by the Department's workforce.