justicedao/ipfs_state_laws huggingface dataset:
943-014-0205 Confidentiality and Inadmissibility of Workplace Interpersonal Dispute Mediation Communications Pursuant to ORS 36.224(4), adopting the Oregon Health Authority rule Confidentiality and Inadmissibility of Workplace Interpersonal Dispute Mediation Communications 943-014-0205 to adopt by reference the Confidentiality and Inadmissibility of Workplace Interpersonal Mediation Communications rule OAR 137-005-0054 adopted by the Attorney General effective as of 10-27-15. Statutory/Other Authority: ORS 36.224, OL 2015 & ch 114 (SB 189) Statutes/Other Implemented: ORS 36.230(4), OL 2015 & ch 114 (SB 189) History: OHA 1-2017, f. & cert. ef. 5-17-17 OHA 25-2011, f. 10-31-11, cert. ef. 11-1-11 OHA 9-2011(Temp), f. & cert. ef. 7-1-11 thru 12-27-11
943-014-0300 Scope These rules (OAR 943-014-0300 through 943-014-0320) apply to an organization or individual seeking or receiving access to Authority information assets or network and information systems for the purpose of carrying out a business transaction between the Authority and the user. (1) These rules are intended to complement, and not supersede, access control or security requirements in the Authority's Electronic Data Transmission rules, OAR 943-120-0100 to 943-120-0200, and whichever rule is more specific shall control. (2) The confidentiality of specific information and the conditions for use and disclosure of specific information are governed by other laws and rules, including but not limited to the Authority's rules for the privacy of protected information, OAR 943-014-0000 to 943-014-0070. Statutory/Other Authority: ORS 413.042 Statutes/Other Implemented: ORS 182.122 History: OHA 27-2011, f. & cert. ef. 12-1-11 OHA 16-2011(Temp), f. & cert. ef. 8-9-11 thru 2-2-12
943-014-0305 Definitions For purpose of these rules, the following terms have definitions set forth below. All other terms not defined in this section shall have the meaning used in the Health Insurance Portability and Accountability Act (HIPAA) security rules found at 45 CFR § 164.304: (1) "Access" means the ability or the means necessary to read, communicate, or otherwise use any Authority information asset. (2) "Access Control Process" means Authority forms and processes used to authorize a user, identify their job assignment, and determine the required access. (3) "Authority" means the Oregon Health Authority. (4) "Client Records" means any client, applicant, or participant information regardless of the media or source, provided by the Authority to the user, or exchanged between the Authority and the user. (5) "Incident" means the attempted or successful unauthorized access, use, disclosure, modification, or destruction of any network and information system or Authority information asset including, but not limited to unauthorized disclosure of information; failure to protect user's identification (ID) provided by the Authority; or, theft of computer equipment that uses or stores any Authority information asset. (6) "Information Asset" means any information, also known as data, provided through the Authority, regardless of the source or media, which requires measures for security and privacy of the information. (7) "Network and Information System" means the State of Oregon's computer infrastructure, which provides personal communications, client records and other sensitive information assets, regional, wide area and local area networks, and the internetworking of various types of networks on behalf of the Authority. (8) "User" means any individual authorized by the Authority to access a network and information system or information asset. (9) "Organization" means any entity authorized by the Authority to access a network and information system or information asset. Statutory/Other Authority: ORS 413.042 Statutes/Other Implemented: ORS 182.122 History: OHA 27-2011, f. & cert. ef. 12-1-11 OHA 16-2011(Temp), f. & cert. ef. 8-9-11 thru 2-2-12
943-014-0310 Information Access The organization or user shall utilize the Authority access control process for all requested and approved access. The Authority shall notify the user of each approval or denial. When approved, the Authority shall provide the user with a unique login identifier to access the network and information system or information asset. The Authority may authorize the use of a generic login identifier. Statutory/Other Authority: ORS 413.042 Statutes/Other Implemented: ORS 182.122 History: OHA 27-2011, f. & cert. ef. 12-1-11 OHA 16-2011(Temp), f. & cert. ef. 8-9-11 thru 2-2-12
943-014-0315 Security Information Assets (1) No organization or user shall access an information asset for any purpose other than that specifically authorized by the Authority access control process. (2) Except as specified or approved by the Authority, no organization or user shall alter, delete, or destroy any information asset. (3) The organization shall prohibit unauthorized access by their staff, contractors, agents, or others to the network and information systems, or Authority information assets, and shall implement safeguards to prevent unauthorized access in accordance with section (4) of this rule. (4) The organization shall develop a security risk management plan. The organization shall ensure that the plan includes, but is not limited to the following: (a) Administrative, technical, and physical safeguards commonly found in the International Standards Organization 27002: 2005 security standard or National Institute of Standards and Technology (NIST) 800 Series; (b) Standards established in accordance with HIPAA Security Rules, 45 CFR Parts 160 and 164, applicable to an organization or user regarding the security and privacy of a client record, any information asset, or network and information system; (c) The organization’s privacy and security policies; (d) Controls and safeguards that address the security of equipment and storage of any information asset accessed to prevent inadvertent destruction, disclosure, or loss; (e) Controls and safeguards that ensure the security of an information asset, regardless of the media, as identified below: (A) The user keeps Authority-assigned access control requirements such as identification of authorized users and access control information (passwords and personal identification numbers (PIN's)), in a secure location until access is terminated; (B) Upon request of the Authority, the organization makes available all information about the user’s use or application of the access controlled network and information system or information asset; and (C) The organization or user ensures the proper handling, storage, and disposal of any information asset obtained or reproduced, and, when the authorized use of that information ends, is consistent with any applicable record retention requirements. (f) Existing security plans developed to address other regulatory requirements, such as Sarbanes-Oxley Act of 2002 (PL 107-204), Title V of Gramm Leach Bliley Act of 1999, Statement on Auditing Standards (SAS) number 70, will be deemed acceptable as long as they address the above requirements. (5) The Authority may request additional information related to the organization’s security measures. (6) The organization or user must immediately notify the Authority when access is no longer required, and immediately cease access to or use of all information assets or network and information systems. Statutory/Other Authority: ORS 413.042 Statutes/Other Implemented: ORS 182.122 History: OHA 27-2011, f. & cert. ef. 12-1-11 OHA 16-2011(Temp), f. & cert. ef. 8-9-11 thru 2-2-12
943-014-0320 User Responsibility The organization or user shall not make any root level changes to any Authority or State of Oregon network and information system. The Authority recognizes that some application users have root level access to certain functions to allow the user to diagnose problems (such as startup or shutdown operations, disk layouts, user additions, deletions or modifications, or other operation) that require root privileges. This access does not give the user the right to make any changes normally restricted to root without explicit written permission from the Authority. (1) Use and disclosure of any Authority information asset is strictly limited to the minimum information necessary to perform the requested and authorized service. (2) The organization shall have established privacy and security measures that meet or exceed the standards set forth in the Authority privacy and information security policies, available from the Authority, regarding the disclosure of an information asset. (3) The organization or user shall comply with all security and privacy federal and state laws, rules, and regulations applicable to the access granted. (4) The organization shall make the security risk plan available to the Authority for review upon request. (5) The organization or user shall report to the Authority all privacy or security incidents by the user that compromise, damage, or cause a loss of protection to the Authority information assets or the network and information systems. The incident report shall be made no later than five business days from the date on which the user becomes aware of such incident. The user shall provide the Authority a written report which must include the results of the incident assessment findings and resolution strategies. (6) Wrongful use of a network and information system, or wrongful use or disclosure of an Authority information asset by the organization or user may cause the immediate suspension or revocation of any access granted, at the sole discretion of the Authority without advance notice. (7) The organization or user shall comply with the Authority's request for corrective action concerning a privacy or security incident and with laws requiring mitigation of harm caused by the unauthorized use or disclosure of confidential information, if any. Statutory/Other Authority: ORS 413.042 Statutes/Other Implemented: ORS 182.122 History: OHA 27-2011, f. & cert. ef. 12-1-11 OHA 16-2011(Temp), f. & cert. ef. 8-9-11 thru 2-2-12
943-014-0400 Purpose These rules set requirements for contractors who are business associates of the health care component of the Oregon Health Authority (Authority) as described in OAR 943-014-0015. Business associates must comply with these rules, the business associate provisions of the Health Insurance Portability and Accountability Act (HIPAA) and HIPAA’s implementing regulations. HIPAA requires covered entities to comply with the requirements set forth in 45 CFR 164.502(e) and 164.504(e) by obtaining certain written assurances from the business associates. Statutory/Other Authority: ORS 413.042 Statutes/Other Implemented: ORS 179.505, 192.553, 192.556 - 192.581, 413.032, 413.042 & 414.065 History: OHA 1-2014, f. 2-12-14, cert. ef. 2-18-14 OHA 1-2013(Temp), f. & cert. ef. 8-23-13 thru 2-18-14
943-014-0410 Definitions As used in OAR 943-014-0400 through 943-014-0465 the following definitions apply. Terms not defined here shall have the same meaning given those terms in the Privacy Rule and the Security Rule, 45 CFR 160 and 164. (1) “Authority” means the Oregon Health Authority. (2) “Breach” has the meaning given that term in 45 CFR 164.402. (3) "Business associate" has the meaning given that term in 45 CFR 160.103. (4) "Contract" means the written agreement between the Authority and a contractor describing the rights and obligations of the parties. (5) "Covered entity" has the meaning given that term in 45 CFR 160.103. (6) “Electronic media” means: (a) Data stored in electronic format; and (b) Transmission media used to exchange information already stored in electronic format. (7) “Electronic protected health information” (EPHI) has the meaning given that term in 45 CFR 160.103. (8) "HIPAA" means the Health Insurance Portability and Accountability Act of 1996, 42 USC 1320d - 1320d-8, Public Law 104-191, sec. 262 and sec. 264. (9) “HITECH Act” means the Health Information Technology for Economic and Clinical Health Act, Title XIII of division A and Title IV of Division B of the American Recovery and Reinvestment Act of 2009, Public Law 111-5, including any implementing regulations. (10) "Privacy rule" means the Standards for Privacy of Individually Identifiable Health Information at 45 CFR part 160 and part 164, subparts A and E. (11) “Protected health information” (PHI) has the meaning given that term in 45 CFR 160.103. (12) “Required by law” has the meaning given that term in 45 CFR 164.103. (13) “Secretary” means the Secretary of Health and Human Services (HHS) or designee. (14) “Security rule” means the security standards for electronic protected health information found at 45 CFR Parts 160, and 164. (15) “Unsecured protected health information” has the meaning given that term in 45 CFR 164.402 Statutory/Other Authority: ORS 413.042 Statutes/Other Implemented: ORS 179.505, 192.553, 192.556 - 192.581, 413.032, 413.042 & 414.065 History: OHA 1-2014, f. 2-12-14, cert. ef. 2-18-14 OHA 1-2013(Temp), f. & cert. ef. 8-23-13 thru 2-18-14
943-014-0430 Authority Obligations (1) To the extent that a business associate's use or disclosure of protected health information and electronic protected health information may be affected, the Authority shall notify business associate of: (a) Limitations in its notice of privacy practices in accordance with 45 CFR 164.520. The Authority may satisfy this obligation by providing business associate with the Authority’s most current Notices of Privacy Practices. (b) Changes in, or revocation of, permission by an individual to use or disclose protected health information or electronic protected health information. (c) Restrictions to the use or disclosure of protected health information or electronic protected health information that the Authority has agreed to in accordance with 45 CFR 164.522. (2) The Authority may not request that a business associate use or disclose protected health information or electronic protected health information in any manner that is not permissible under the Privacy Rule or Security Rule if done by the Authority, except as permitted by OAR 943-014-0420. Statutory/Other Authority: ORS 413.042 Statutes/Other Implemented: ORS 179.505, 192.553, 192.556 - 192.581, 413.032, 413.042 & 414.065 History: OHA 1-2014, f. 2-12-14, cert. ef. 2-18-14 OHA 1-2013(Temp), f. & cert. ef. 8-23-13 thru 2-18-14
943-014-0435 Contractor Security Requirements (1) Contractors must comply with the Security Rule’s business associate requirements for electronic protected health information and must comply with both the Privacy Rule and the Security Rule requirements applicable to a business associate. (2) Contractors must: (a) Implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of the protected health information and electronic protected health information that it creates, receives, maintains, or transmits on behalf of the Authority. (b) Develop and enforce policies, procedures, and documentation standards (including designation of a security official) related to the administrative, physical, and technical safeguards that protect electronic protected health information. (c) When required by OAR 943-014-0415(5), enter into a business associate agreement with any agent or subcontractor to ensure the agent or subcontractor agrees to implement reasonable and appropriate safeguards to protect electronic protected health information the contractor provides. Statutory/Other Authority: ORS 413.042 Statutes/Other Implemented: ORS 179.505, 192.553, 192.556 - 192.581, 413.032, 413.042 & 414.065 History: OHA 1-2014, f. 2-12-14, cert. ef. 2-18-14 OHA 1-2013(Temp), f. & cert. ef. 8-23-13 thru 2-18-14
943-014-0440 Breach (1) For the purposes of this rule a breach is considered “discovered” in accordance with 45 CFR 164.404(a)(2) and 45 CFR 164.410(2). (2) In the event a breach of unsecured protected health information is discovered, a contractor must: (a) Notify the Authority of the breach. (A) The notification must be made as soon as possible and business associate shall confer with the Authority as soon as practicable thereafter. (B) The notification must be made to the Authority no later than 30 calendar days after the discovery of breach. (C) Notification shall include identification of each individual whose unsecured protected health information has been, or is reasonably believed to have been accessed, acquired, or disclosed during the breach. (D) Notification shall include steps taken to mitigate harm, steps taken to reasonably ensure a like breach will not occur in the future, and any other information that may be reasonably required by the Authority for the Authority to meet its obligations. (b) Confer with the Authority regarding preparing and issuing an appropriate notice to each individual whose unsecured protected health information has been, or is reasonably believed to have been accessed, acquired, or disclosed as a result of a breach. (c) Confer with the Authority regarding preparing and issuing an appropriate notice to prominent media outlets within the state or local jurisdictions when the breach involves more than 500 individuals. (d) Make the appropriate notification to media outlets and individuals affected by the breach as necessary. (e) Confer with the Authority regarding preparing and issuing notice of the breach to the Secretary. (A) If the breach involves 500 or more individuals, the notice to the Secretary must be provided immediately. (B) Any breach involving less than 500 individuals shall be documented in a log and the log provided to the Secretary annually, no later than 60 calendar days after December 31 of each year. (3) Except as set forth in section (5) of this rule, notifications required by this rule must be made without unreasonable delay and no later than 60 calendar days after the discovery of a breach. (4) Notice must be provided in the manner and content required by 45 CFR 164.404 through 164.410. (5) Any notification required by this rule may be delayed by a law enforcement official in accordance with the 45 CFR 164.412. Statutory/Other Authority: ORS 413.042 Statutes/Other Implemented: ORS 179.505, 192.553, 192.556 - 192.581, 413.032, 413.042 & 414.065 History: OHA 1-2014, f. 2-12-14, cert. ef. 2-18-14 OHA 1-2013(Temp), f. & cert. ef. 8-23-13 thru 2-18-14
943-014-0445 Violations (1) When the Authority learns about a business associate’s failure to comply with these rules the Authority shall notify the business associate of the rule violation and provide a reasonable opportunity for the business associate to remedy or end the violation. (2) The Authority may terminate the contract if business associate does not cure the breach or end the violation within the time specified by the Authority. (3) The Authority shall immediately terminate the contract if business associate has violated these rules and remedy is not possible in the Authority’s reasonable judgment. Statutory/Other Authority: ORS 413.042 Statutes/Other Implemented: ORS 179.505, 192.553, 192.556 - 192.581, 413.032, 413.042 & 414.065 History: OHA 1-2014, f. 2-12-14, cert. ef. 2-18-14 OHA 1-2013(Temp), f. & cert. ef. 8-23-13 thru 2-18-14
943-014-0450 Termination of Contract (1) Except as provided in section (2) of this rule, upon termination of the contract for any reason, the business associate shall, at the request of the Authority, return or destroy all protected health information and electronic protected health information created, maintained or received by the business associate from the Authority or on the Authority’s behalf. (a) This section shall apply to protected health information and electronic protected health information that is in the possession of subcontractors or agents of the business associate. (b) Business associate may not retain copies of the protected health information and electronic protected health information. (2) If the business associate determines that returning or destroying the protected health information or electronic protected health information is not feasible, the business associate shall provide the Authority notification of the conditions that make return or destruction not feasible. (a) Upon the Authority's written acknowledgement that return or destruction of protected health information or electronic protected health information is not feasible, the business associate shall continue to provide the protections to the information required by these rules and the contract. (b) Business associate shall limit further uses and disclosures of the information to those purposes that make the return or destruction not feasible, for as long as the business associate maintains the protected information. Statutory/Other Authority: ORS 413.042 Statutes/Other Implemented: ORS 179.505, 192.553, 192.556 - 192.581, 413.032, 413.042 & 414.065 History: OHA 1-2014, f. 2-12-14, cert. ef. 2-18-14 OHA 1-2013(Temp), f. & cert. ef. 8-23-13 thru 2-18-14
943-014-0455 Order of Precedence (1) These rules shall be interpreted as broadly as necessary to implement and comply with HIPAA, the Privacy Rule, the Security Rule, and the HITECH Act. (2) Any ambiguity in these rules shall be resolved in favor of a meaning that complies and is consistent with HIPAA, the Privacy Rule, the Security Rule, and the HITECH Act. (3) Any ambiguity in the contract shall be resolved to permit the Authority and business associate to implement and comply with HIPAA, the HITECH Act, the Privacy Rule and the Security Rule. (4) If a conflict arises between these rules and the provisions of the contract, these rules shall control. (5) If a conflict arises between the provisions of the contract and the Privacy Rule, the Security Rule, or the HITECH Act, the Privacy Rule, the Security Rule, and the HITECH Act shall control. (6) If conflict arises between these rules and the Privacy Rule, Security Rule, or HITECH Act, the Privacy Rule, Security Rule, and the HITECH Act shall control. (7) These rules shall not supersede any other federal or state law or regulation governing the legal relationship of the parties, or the confidentiality of records or information, except to the extent that HIPAA and the HITECH Act preempt those laws or regulations. Statutory/Other Authority: ORS 413.042 Statutes/Other Implemented: ORS 179.505, 192.553, 192.556 - 192.581, 413.032, 413.042 & 414.065 History: OHA 1-2014, f. 2-12-14, cert. ef. 2-18-14 OHA 1-2013(Temp), f. & cert. ef. 8-23-13 thru 2-18-14
943-014-0460 Authority Compliance Methods The Authority may comply with these rules: (1) By incorporating the business associate requirements contained in this rule into its contracts with business associates or by referencing these rules. (2) By entering into a memorandum of understanding that accomplishes the objectives of these rules and meets the business associate requirements of the Privacy Rule and Security Rule, if the business associate is a government entity. (3) By executing an amendment or rider that contains the contract provisions required by these rules or references to these rules and that amends the Authority’s contract with the business associate. Statutory/Other Authority: ORS 413.042 Statutes/Other Implemented: ORS 179.505, 192.553, 192.556 - 192.581, 413.032, 413.042 & 414.065 History: OHA 1-2014, f. 2-12-14, cert. ef. 2-18-14 OHA 1-2013(Temp), f. & cert. ef. 8-23-13 thru 2-18-14
943-014-0465 Standards in Individual Contracts (1) The Authority and a business associate may enter into a contract that contains more strict standards than those set forth in these rules as long as the standards do not violate the requirements of the Privacy Rule, Security Rule, or the HITECH Act, and the contract receives approval from the Oregon Department of Justice. (2) If the Authority and a business associate enter into a contract containing more strict standards than those set forth in these rules, the business associate shall require subcontractors who are business associates to comply with the stricter standards. Statutory/Other Authority: ORS 413.042 Statutes/Other Implemented: ORS 179.505, 192.553, 192.556 - 192.581, 413.032, 413.042 & 414.065 History: OHA 1-2014, f. 2-12-14, cert. ef. 2-18-14 OHA 1-2013(Temp), f. & cert. ef. 8-23-13 thru 2-18-14