OAR 407-014-0070: De-identification of Client Information and Use of Limited Data Sets under Data Use Agreements

(1) The Department may use and disclose information as appropriate for the work of the Department, without further restriction, if the Department or another entity has taken steps to de-identify the information pursuant to 45 CFR part 164.514(a) and (b). (2) The Department may assign a code or other means of record identification to allow the Department to re-identify the de-identified information provided that: (a) The code or other means of record identification is not derived from or related to information about the individual and cannot otherwise be translated to identify the individual; and, (b) The Department does not use or disclose the code or other means of record identification for any other purpose, and does not disclose the mechanism for re-identification. (3) The Department may use and disclose a limited data set if the Department enters into a data use agreement with an entity requesting or providing the Department with a limited data set subject to the requirements of 45 CFR part 164.514(e). (a) The Department may use and disclose a limited data set for the purposes of research. The Department may use limited data set for its own activities or operations if the Department has obtained a limited data set that is subject to a data use agreement. (b) If the Department knows of a pattern of activity or practice of a limited data set recipient that constitutes a material breach or violation of a data use agreement, the Department shall take reasonable steps to cure the breach or end the violation. If such steps are unsuccessful, the Department shall discontinue disclosure of information to the recipient and report the problem to the appropriate authority.