ORS 441.201: Flagging systems.

(1) As used in this section: (a) “Authorized staff” means the staff of a covered entity who are responsible for creating and tracking electronic health record flags. (b) “Covered entity” means: (A) A hospital as defined in ORS 441.760, except for the Oregon State Hospital. (B) A home health agency as defined in ORS 443.014. (C) A home hospice program as defined in ORS 654.412. (c) “Disruptive behavior” includes physically aggressive, harassing or destructive behavior. (d) “Electronic health record” has the meaning given that term in ORS 413.300. (e) “Electronic health record flag” means an alert generated within the electronic health record of a patient that notifies providers that a patient may pose a potential safety risk to themselves or to others due to the patient’s history of violent or disruptive behavior. (f) “Flagging system” means a system used to identify, communicate, monitor and manage potential threats of violence or disruptive behavior by patients or other individuals who may encounter health care providers and staff. (g) “Health care provider” or “provider” has the meaning given those terms in ORS 413.300. (h) “Visual flags” means paper-based physical cues, including wristbands, signage, color-coded indicators, symbols and other visible cues built within the care environment to facilitate immediate recognition of potential threats of violence or disruptive behavior without having to access an electronic health record. (2) A covered entity shall implement flagging systems with the capabilities and functions to communicate potential threats of violence or disruptive behavior to providers and staff of the covered entity using electronic health record flags and visual flags. (3) Each covered entity shall establish protocols and procedures regarding implementation and use of flagging systems. At a minimum, the protocols and procedures must address: (a) For electronic health record flags and visual flags: (A) Criteria and processes for initiation, continuation, inactivation and reactivation of such flags. (B) Requirements for new and revised electronic health record flags and visual flags that include: (i) The reasons for initiating or revising such flags; and (ii) Specific recommended actions that providers and staff of the covered entity should take when interacting with a flagged individual. (b) For electronic health record flags: (A) Designating authorized staff to initiate an electronic health record flag. (B) Training and education requirements for persons authorized to initiate an electronic health record flag, including training on identifying and preventing bias in the assignment of such flags. (C) Provider and staff responsibilities when an electronic health record flag is present. (D) Evaluating and identifying potential threats of violence or disruptive behavior. (E) Consistent practices for assigning, tracking, monitoring and documenting information in the electronic health record flag. (F) Reviewing and updating electronic health record flags, as necessary, for purposes of determining whether to remove or maintain a flag. (G) Communication and collaboration about flagged conduct or behaviors recorded in an electronic health record flag. (H) Safety protocols and precautions for engaging with patients with an electronic health record flag. (I) Patient privacy in relation to worker safety, including compliance with patient privacy requirements under the federal Health Insurance Portability and Accountability Act privacy regulations, 45 C.F.R. parts 160 and 164, when communicating information through the electronic health record regarding an electronic health record flag. (J) Requiring that every flag-related action, including but not limited to initiation, continuation, inactivation or reactivation, be supported by a linked clinical note that documents the justification for the action. (K) Establishing a process by which a patient, or a person authorized to make health care decisions on behalf of the patient, may request review and removal of an electronic health record flag. (c) For visual flags, education and training for authorized staff of a covered entity on: (A) Identifying circumstances and assessing behaviors and actions of patients and other individuals that may increase risk for potential violence or disruptive behavior; (B) Consistent approaches to initiating a visual flag; and (C) Safety protocols and precautions to take when encountering patients or other individuals when a visual flag is present. (4) Providers and staff of a covered entity may not take any of the following actions based solely on the presence of an electronic health record flag: (a) Deny admission to a program or service provided by the covered entity to which the patient would otherwise be eligible. (b) Make decisions regarding the patient’s access to care. (c) Prevent or restrict the right of the patient to file a complaint with the appropriate federal or state agency concerning the patient’s right to privacy. (d) Deny or restrict the patient’s right to access or obtain the patient’s protected health information. (e) Contact, report or disclose information to law enforcement. (f) Deny, restrict or withhold medical or nonmedical care that is appropriate for the patient. (g) Punish or penalize the patient. [2025 c.535 §9]