OAR 943-014-0020: Uses and Disclosures of Client or Participant Protected Information

(1) Uses and disclosures with individual authorization. The Authority must obtain a completed and signed authorization for release of information from the individual, or the individual’s personal representative, before obtaining or using protected information about an individual from a third party or disclosing protected information about the individual to a third party. (a) Uses and disclosures must be consistent with what the individual has approved on the signed authorization form approved by the Authority. (b) An individual may revoke an authorization at any time. The revocation must be in writing and signed by the individual, except that substance abuse treatment patients may orally revoke an authorization to disclose information obtained from substance abuse treatment programs. No revocation shall apply to information already released while the authorization was valid and in effect. (2) Uses and disclosures without authorization. The Authority may use and disclose information without written authorization in the following circumstances: (a) The Authority may disclose information to individuals who have requested disclosure to themselves of their information, if the individual has the right to access the information under OAR 943-014-0030(6). (b) If the law requires or permits the disclosure, and the use and disclosure complies with, and is limited to, the relevant requirements of the relevant law. (c) For treatment, payment, and health care operations the Authority may disclose the following information: (A) Activities involving the current treatment of an individual, for the Authority or health care provider; (B) Payment activities, for the Authority, covered entity, or health care provider; (C) Protected health information for the purpose of health care operations; and (D) Substance abuse treatment information, if the recipient has a Qualified Service Organization Agreement with the Authority. (d) Psychotherapy notes. The Authority may only use and disclose psychotherapy notes in the following circumstances: (A) In the Authority’s supervised counseling training programs; (B) In connection with oversight of the originator of the psychotherapy notes; or (C) To defend the Authority in a legal action or other proceeding brought by the individual. (e) Public health activities. (A) The Authority may disclose an individual’s protected information to appropriate entities or persons for governmental public health activities and for other purposes including but not limited to: (i) A governmental public health authority that is authorized by law to collect or receive protected information for the purpose of preventing or controlling disease, injury, or disability. This includes but is not limited to reporting disease, injury, and vital events such as birth or death; and the conducting of public health surveillance, investigations, and interventions; (ii) An official of a foreign government agency that is acting in collaboration with a governmental public health authority; (iii) A governmental public health authority, or other government authority that is authorized by law to receive reports of child abuse or neglect; (iv) A person subject to the jurisdiction of the federal Food and Drug Administration (FDA), regarding an FDA-regulated product or activity for which that person is responsible for activities related to the quality, safety, or effectiveness of an FDA-regulated product or activity; or (v) A person who may have been exposed to a communicable disease, or may be at risk of contracting or spreading a disease or condition, if the Authority or other public health authority is authorized to notify the person as necessary in conducting a public health intervention or investigation. (B) Where state or federal law prohibits or restricts use and disclosure of information obtained or maintained for public health purposes, the Authority shall deny the use and disclosure. (f) Child abuse reporting and investigation. If the Authority has reasonable cause to believe that a child is a victim of abuse or neglect, the Authority may disclose protected information to appropriate governmental authorities authorized by law to receive reports of child abuse or neglect. (g) Adult abuse reporting and investigation. If the Authority has reasonable cause to believe that a vulnerable adult is a victim of abuse or neglect, the Authority may disclose information, as required by law, to a government authority or regulatory agency authorized by law to receive reports of abuse or neglect including but not limited to a social service or protective services agency authorized by law to receive such reports. Vulnerable adults are adults age 65 or older and persons with disabilities. (h) Health oversight activities. The Authority may disclose information without authorization for health oversight activities, including audits; civil, criminal, or administrative investigations, prosecutions, licensing or disciplinary actions; Medicaid fraud; or other necessary oversight activities. (i) Administrative and court hearings, grievances, investigations, and appeals. (A) The Authority may use or disclose information for an investigation, administrative or court hearing, grievance, or appeal about an individual’s eligibility or right to receive Authority benefits or services. (B) If the Authority has obtained information in performing its duties as a health oversight agency, public health authority, or public benefit program, the Authority may use or disclose that information in an administrative or court hearing consistent with the other privacy requirements applicable to that program, service, or activity. (j) Court orders. The Authority may disclose information for judicial or administrative proceedings in response to a court order, subpoena, discovery request, or other legal process. If a court orders the Authority to conduct a mental examination pursuant to ORS 161.315, 161.365, 161.370, or orders the Authority to provide any other report or evaluation to the court, the examination, report, or evaluation shall be deemed to be required by law for purposes of HIPAA. (k) Law enforcement purposes. For limited law enforcement purposes, the Authority may report certain injuries or wounds; provide information to identify or locate a suspect, victim, or witness; alert law enforcement of a death as a result of criminal conduct; and provide information which constitutes evidence of criminal conduct on Authority premises. (A) The Authority may provide client information to a law enforcement officer in any of the following situations: (i) The law enforcement officer is involved in carrying out any investigation, criminal, or civil proceedings connected with administering the program from which the information is sought; (ii) An Authority employee may disclose information from personal knowledge that does not come from the client’s interaction with the Authority; (iii) The disclosure is authorized by statute or administrative rule; (iv) The information informs law enforcement of a death as a result of criminal conduct; (v) The information constitutes evidence of criminal conduct on Authority premises; or (vi) The disclosure is necessary to protect the client or others, and the client poses a threat to his or her safety or to the safety of others. (B) Except as provided in section (2)(k)(C) of this rule, the Authority may give a client’s current address, Social Security number, and photo to a law enforcement officer if the law enforcement officer makes the request in the course of official duty, supplies the client’s name, and states that the client: (i) Is a fugitive felon or is violating parole, probation, or post-prison supervision; (ii) For all public assistance programs, has information that is necessary for the officer to conduct official duties, and the location or apprehension of the client is within the officer’s official duties; or (C) If domestic violence has been identified in the household, the Authority may not release information about a victim of domestic violence unless a member of the household is either wanted as a fugitive felon or is violating parole, probation, or post-prison supervision. (D) For purposes of this subsection, a fugitive felon is a person fleeing to avoid prosecution or custody for a crime, or an attempt to commit a crime, that would be classified as a felony. (E) For purposes of this section, a law enforcement officer is an employee of the Oregon State Police, a county sheriff’s department, or a municipal police department, whose official duties include arrest authority. (l) Use and disclosure of information about deceased individuals. (A) The Authority may disclose individual information to a coroner or medical examiner for the purpose of identifying a deceased individual, determining cause of death, or other duties authorized by law. (B) The Authority may disclose individual information to funeral directors as needed to carry out their duties regarding the decedent. The Authority may also disclose individual information prior to, and in anticipation of, the death. (m) Organ or tissue donation. The Authority may disclose individual information to organ procurement organizations or other entities engaged in procuring, banking, or transplanting cadaver organs, eyes, or tissue for the purpose of facilitating transplantation. (n) Research. The Authority may disclose individual information without authorization for research purposes, as specified in OAR 943-014-0060. (o) Threat to health or safety. To avert a serious threat to health or safety the Authority may disclose individual information if: (A) The Authority believes in good faith that the information is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public; and (B) The report is to a person or persons reasonably able to prevent or lessen the threat, including the target of the threat. (p) National security and intelligence. The Authority may disclose information to authorized federal officials for lawful intelligence, counterintelligence, and other national security activities. (q) Correctional institutions and law enforcement custody situations. The Authority may disclose information to a correctional institution or a law enforcement official having lawful custody of an inmate or other person, for the limited purpose of providing health care or ensuring the health or safety of the person or other inmates. (r) Emergency treatment. In case of an emergency, the Authority may disclose individual information to the extent needed to provide emergency treatment. (s) Government entities providing public benefits. The Authority may disclose eligibility and other information to governmental entities administering a government program providing public benefits. (3) Authorization not required if opportunity to object given. The Authority may use and disclose an individual’s information without authorization if the Authority informs the individual in advance and gives the individual an opportunity to either agree or refuse or restrict the use and disclosure. (a) These disclosures are limited to disclosure of information to a family member, other relative, close personal friend of the individual, or any other person named by the individual, subject to the following limitations: (A) The Authority may disclose only the protected information that directly relates to the person’s involvement with the individual’s care or payment for care. (B) The Authority may use and disclose protected information for notifying, identifying, or locating a family member, personal representative, or other person responsible for care of the individual, regarding the individual’s location, general condition, or death. For individuals who had resided at one time at the state training center, OAR 411-320-0090(6) addresses family reconnection. (C) If the individual is present for, or available prior to, a use and disclosure, the Authority may disclose the protected information if the Authority: (i) Obtains the individual’s agreement; (ii) Provides the individual an opportunity to object to the disclosure, and the individual does not object; or (iii) Reasonably infers from the circumstances that the individual does not object to the disclosure. (D) If the individual is not present, or the opportunity to object to the use and disclosure cannot practicably be provided due to the individual’s incapacity or an emergency situation, the Authority may disclose the information if, using professional judgment, the Authority determines that the use and disclosure is in the individual’s best interests. (b) Exception. For individuals referred to or receiving substance abuse treatment, mental health, or vocational rehabilitation services, the Authority shall not use or disclose information without written authorization, unless disclosure is otherwise permitted under 42 CFR part 2, 34 CFR 361.38, or ORS 179.505. (c) Personal representative. The Authority must treat a personal representative as the individual for purposes of these rules, except that: (A) A personal representative must be authorized under state law to act on behalf of the individual with respect to use and disclosure of information. The Authority may require a personal representative to provide a copy of the documentation authorizing the person to act on behalf of the individual. (B) The Authority may elect not to treat a person as a personal representative of an individual if: (i) The Authority has a reasonable belief that the individual has been or may be subjected to domestic violence, abuse, or neglect by the person; (ii) The Authority, in the exercise of professional judgment, decides that it is not in the best interest of the individual to treat the person as the individual’s personal representative. (4) Redisclosure. The Authority must inform the individual that information held by the Authority and authorized by the individual for disclosure may be subject to redisclosure and no longer protected by these rules. (5) Specific written authorization. If the use or disclosure of information requires an authorization, the authorization must specify that the Authority may use or disclose vocational rehabilitation records, alcohol and drug records, HIV/AIDS records, genetics information, and mental health or developmental disability records held by publicly funded providers. (a) Pursuant to federal regulations at 42 CFR part 2 and 34 CFR 361.38, the Authority may not make further disclosure of vocational rehabilitation and alcohol and drug rehabilitation information without the specific written authorization of the individual to whom it pertains. (b) Pursuant to ORS 433.045 and OAR 333-012-0270, the Authority may not make further disclosure of individual information pertaining to HIV/AIDS. (c) Pursuant to ORS 192.531 to 192.549, the Authority may not make further disclosure pertaining to genetic information. (6) Verification of person or entity requesting information. The Authority may not disclose information about an individual without first verifying the identity of the person or entity requesting the information, unless the Authority workforce member fulfilling the request already knows the person or has already verified identity. (7) Whistleblowers. The Authority may disclose an individual’s protected health information under the HIPAA privacy rules under the following circumstances: (a) The Authority workforce member or business associate believes in good faith that the Authority has engaged in conduct that is unlawful or that otherwise violates professional standards or Authority policy, or that the care, services, or conditions provided by the Authority could endanger Authority staff, individuals in Authority care, or the public; and (b) The disclosure is to a government oversight agency or public health authority, or an attorney of an Authority workforce member or business associate retained for the purpose of determining the legal options of the workforce member or business associate with regard to the conduct alleged under section (7)(a) above; and (c) Nothing in this rule is intended to interfere with ORS 659A.200 to 659A.224 describing the circumstances applicable to disclosures by Authority workforce or business associates.