OAR 409-021-0140: Requests and Requirements to Obtain Restricted Health Data Sets

(1) The Office may authorize the disclosure of health data in accordance with an approved data use agreement entered into by both the Office and a researcher, pursuant to which the Office may disclose a restricted health data set to a researcher for research, public health, or health care operations. The intent of this rule is to generally apply the legal standard established in the HIPAA Privacy Rule applicable to limited data sets, 45 CFR 164.514(e). (2) Any requestor who wishes to obtain restricted health data sets from the Office shall provide all of the following: (a) Form D-1 (Research Data Request) (b) Form D-2 (Data Order Form) (c) Form D-3 (Data Use Agreement) (d) Full payment of fees. (3) All requests for restricted health data sets require the written approval of the Research and Data Manager. (4) Upon approval and receipt of full payment of fees, the Office is authorized to provide one copy of the requested restricted health data set to the requestor. (5) The Office shall respond to restricted health data set requests within a reasonable period of time, except that the Office’s response may be delayed so that critical operations and activities are not unduly disrupted. The Office shall notify the requestor in writing if an extensive delay is anticipated. [ED. NOTE: Forms referred are available from the agency.]