justicedao/ipfs_state_laws huggingface dataset:
407-012-0010 Prohibited Conduct (1) Conduct that may result in restriction of access includes, but is not limited to the following: (a) Causing or threatening to cause physical injury to Department employees or visitors; (b) Engaging in actions which compromise the safety or health of Department employees or visitors; (c) Causing or threatening to cause harm to the family or property of an employee or visitors through written, electronic, or verbal communication; (d) Causing or threatening to cause damage to Department premises; (e) Bringing a deadly or dangerous weapon onto the Department’s premises, unless authorized by ORS chapter 166 to carry a handgun; (f) Displaying, attempting, or threatening to use any weapon, on or off Department premises, that compromises the safety of Department employees or visitors; (g) Engaging in harassing conduct as defined in ORS 166.065. (h) Engaging in telephonic harassment as defined in ORS 166.090. (2) The conduct listed in section (1) is also prohibited if it occurs during employees’ off-work hours and off Department premises and the prohibited conduct is related to the employee’s work with the Department. (3) Prior to issuing a restriction of access notice, the Department will make an individualized assessment as to whether the conduct listed in section (1) of this rule is a result of a disability of which the Department has knowledge and whether the conduct is a “direct threat” to others as described in OAR 407-005-0000 through 407-005-0030. If the Department determines the disabled individual’s conduct is not a direct threat, the Department will explore the possibility of a reasonable accommodation to mitigate the safety risk. (4) The prohibitions on conduct in this rule do not apply to individuals who are residents of a Department-operated residential facility. Statutory/Other Authority: ORS 409.050 Statutes/Other Implemented: ORS 409.050 & 654.010 History: DHSD 11-2007, f. 11-30-07, cert. ef. 12-1-07
407-012-0015 Continuation of Eligible Services (1) An individual whose access has been restricted by the Department will continue to be provided services for which the individual meets program eligibility requirements by an alternate and effective method of communication as determined by the Department. (2) Alternate methods may include telephone, electronic mail, written communication, meeting at a designated secure site, or through the individual’s representative. Statutory/Other Authority: ORS 409.050 Statutes/Other Implemented: ORS 409.050 & 654.010 History: DHSD 11-2007, f. 11-30-07, cert. ef. 12-1-07
407-012-0020 Notification (1) If the Department determines that it is necessary to restrict access or the methods of communication because of prohibited conduct, the individual will be provided written notification, signed by the assistant director or deputy assistant director of the affected division, and sent by certified mail or other traceable means. The notice will describe the following: (a) Conduct giving rise to the restrictions; (b) The specific premises or parts of premises from which the individual is excluded; or the forms of communication which are restricted; (c) The alternate method by which services may be obtained; (d) Contact information for services or appointment scheduling; (e) The availability of the review process, including notification that individuals with disabilities are entitled to request modification; (f) The potential criminal consequences for violating the notice of restriction of access; and (g) The law enforcement agency being notified. (2) The notice will be effective upon issuance. (3) Restrictions on access to Department premises or methods of communication will remain in place until the Department determines the individual no longer poses a threat and issues an official notification of removal. Statutory/Other Authority: ORS 409.050 Statutes/Other Implemented: ORS 409.050 & 654.010 History: DHSD 11-2007, f. 11-30-07, cert. ef. 12-1-07
407-012-0025 Department Review (1) The Department will establish an internal review process to ensure that a notice of restriction of access is warranted prior to issuing a written notice of restriction of access. (2) Following the Department’s issuance of a notice of restriction of access, the recipient of the notice may request review of the Department’s determination. The request must be submitted to the office of the Director of the Department. The request must be in writing and submitted, by mail or personal delivery, within 15 business days of the date of issuance of the notice of restriction of access. If the request is submitted by mail, it must be postmarked within 15 business days. No particular format is required for the request for review; however, the individual should include specific grounds for requesting the review. (3) Upon receipt of a request for review, the Director or an assistant director will review the request and issue a written decision. The review may include an informal conference. The decision will be issued within ten days of receipt of the request for review. (4) The Department’s decision is final. (5) If the Department’s decision rules in favor of the individual, the restricted individual’s access restriction will be immediately lifted. If the decision is unfavorable to the restricted individual, the restricted individual may seek further review after six months have lapsed since the date of issuance by following the process described in this rule. Statutory/Other Authority: ORS 409.050 Statutes/Other Implemented: ORS 409.050 & 654.010 History: DHSD 11-2007, f. 11-30-07, cert. ef. 12-1-07
407-014-0015 Information Governed by the HIPAA Privacy Rules (1) These rules address information that, among other things, may be PHI that is protected by the HIPAA Privacy Rules. For purposes of HIPAA Privacy Rules, the Authority is a covered entity, primarily because of its role as the state Medicaid and Children’s Health Insurance Program. (2) The Authority administers many aspects of the medical assistance program with the assistance of the Department, including but not limited to eligibility determinations for the medical assistance program and supervising the long-term and community-based services for seniors and people with disabilities. The Department also provides certain health care operations services for the Authority. In doing so, the Department is a business associate of the Authority. As a business associate of the Authority, the Department is authorized to use and disclose protected health information to perform or assist the Authority in the performance of its covered functions, in a manner consistent with these rules. (3) These rules only apply to information maintained by the Department as a business associate of the Authority. Statutory/Other Authority: ORS 409.050 Statutes/Other Implemented: ORS 409.010 History: DHSD 11-2011, f. & cert. ef. 12-16-11 DHSD 2-2011(Temp), f. & cert. ef. 7-1-11 thru 12-27-11
407-014-0040 Minimum Necessary Standards (1) The Department shall limit the use and disclosure of protected information to that which is reasonably necessary to accomplish the intended purpose of the use or disclosure which is referred to in these rules as the minimum necessary standard. (2) This minimum necessary standard is not intended to impede essential Department activities. (3) The minimum necessary standard applies: (a) When using protected information within the Department; (b) When disclosing protected information to a third party in response to a request; or (c) When requesting protected information from another covered entity. (4) The minimum necessary standard does not apply to: (a) Disclosures to or requests by a health care provider for treatment; (b) Disclosures made to the individual, including disclosures made in response to a request for access or an accounting; (c) Disclosures made with a valid authorization; (d) Disclosures made to DHHS for the purposes of compliance and enforcement of federal regulations under 45 CFR part 160 and required for compliance with 45 CFR part 164; or (e) Uses and disclosures required by law; (5) When requesting protected information about an individual from another entity, the Department shall limit requests to those that are reasonably necessary to accomplish the purposes for which the request is made. The Department shall not request a person’s entire medical record unless the Department can specifically justify the need for the entire medical record. Statutory/Other Authority: ORS 409.050 Statutes/Other Implemented: 409.010 History: DHSD 11-2011, f. & cert. ef. 12-16-11 DHSD 2-2011(Temp), f. & cert. ef. 7-1-11 thru 12-27-11 Renumbered from 410-014-0040 by DHSD 5-2009, f. & cert. ef. 7-1-09 OMAP 26-2003, f. 3-31-03 cert. ef. 4-1-03
407-014-0050 Business Associate (1) The Department is a business associate of the Authority. The Authority is the single state Medicaid agency, but the Department performs or assists in the performance of key components of the medical assistance program under the supervision of the Authority including but not limited to eligibility determinations for the medical assistance program and supervising the long-term and community-based services for seniors and people with disabilities. The Department also provides certain health care operations services for the Authority. In doing so, the Department is a business associate of the Authority. As a business associate of the Authority, the Department is authorized to use and disclose protected health information to perform or assist the Authority in the performance of its covered functions. However, as a business associate, the Department is subject to the privacy requirements described in these rules. (2) As a business associate of the Authority implementing the requirements of the medical assistance program, the Department may disclose an individual’s PHI to its contractors or providers, and may allow its contractors or providers to create or receive an individual’s PHI on behalf of the Department if the contract or agreement that complies with applicable federal and state law. In some limited circumstances, the Department may determine that the Department is a business associate of a covered entity. A business associate relationship with the Department requires additional contractual disclosure and privacy provisions that must be incorporated into the contract pursuant to 45 CFR part 164-504(e)(1). (3) A contract with a business associate must comply with OAR 125-055-0100 to 125-055-0130 and the qualified service organization requirements in 42 CFR part 2.11. Statutory/Other Authority: ORS 409.050 Statutes/Other Implemented: 409.010 History: DHSD 11-2011, f. & cert. ef. 12-16-11 DHSD 2-2011(Temp), f. & cert. ef. 7-1-11 thru 12-27-11 Renumbered from 410-014-0050 by DHSD 5-2009, f. & cert. ef. 7-1-09 OMAP 26-2003, f. 3-31-03 cert. ef. 4-1-03
407-014-0070 De-identification of Client Information and Use of Limited Data Sets under Data Use Agreements (1) The Department may use and disclose information as appropriate for the work of the Department, without further restriction, if the Department or another entity has taken steps to de-identify the information pursuant to 45 CFR part 164.514(a) and (b). (2) The Department may assign a code or other means of record identification to allow the Department to re-identify the de-identified information provided that: (a) The code or other means of record identification is not derived from or related to information about the individual and cannot otherwise be translated to identify the individual; and, (b) The Department does not use or disclose the code or other means of record identification for any other purpose, and does not disclose the mechanism for re-identification. (3) The Department may use and disclose a limited data set if the Department enters into a data use agreement with an entity requesting or providing the Department with a limited data set subject to the requirements of 45 CFR part 164.514(e). (a) The Department may use and disclose a limited data set for the purposes of research. The Department may use limited data set for its own activities or operations if the Department has obtained a limited data set that is subject to a data use agreement. (b) If the Department knows of a pattern of activity or practice of a limited data set recipient that constitutes a material breach or violation of a data use agreement, the Department shall take reasonable steps to cure the breach or end the violation. If such steps are unsuccessful, the Department shall discontinue disclosure of information to the recipient and report the problem to the appropriate authority. Statutory/Other Authority: ORS 409.050 Statutes/Other Implemented: ORS 409.010 History: DHSD 11-2011, f. & cert. ef. 12-16-11 DHSD 2-2011(Temp), f. & cert. ef. 7-1-11 thru 12-27-11 Renumbered from 410-014-0070 by DHSD 5-2009, f. & cert. ef. 7-1-09 OMAP 26-2003, f. 3-31-03 cert. ef. 4-1-03
407-014-0200 Confidentiality and Inadmissibility of Mediation Communications Pursuant to ORS 36.224, the Department of Human Services adopts by reference OAR 137-005-0052 as promulgated by the Attorney General effective as of 11-13-2018. Statutory/Other Authority: ORS 36.224, 184.340 & 409.050 Statutes/Other Implemented: ORS 36.224, ORS 36.228, 36.230 & 36.232 History: DHS 6-2023, amend filed 10/09/2023, effective 10/09/2023 DHSD 5-2017, f. & cert. ef. 5-16-17 DHSD 4-2017(Temp), f. 5-11-17, cert. ef. 5-15-17 thru 11-10-17 Renumbered from 410-006-0011, DHSD 6-2007, f. 6-29-07, cert. ef. 7-1-07 OMAP 8-1999, f. & cert. ef. 3-1-99
407-014-0205 Confidentiality and Inadmissibility of Workplace Interpersonal Dispute Mediation Communications Pursuant to ORS 36.224, the Department of Human Services adopts by reference OAR 137-005-0054 as promulgated by the Attorney General effective as of November 13, 2018. Statutory/Other Authority: ORS 36.224, 409.050 & OL 2015, Ch. 114 (SB 189) Statutes/Other Implemented: ORS 36.230 & OL 2015, Ch. 114 (SB 189) History: DHS 8-2021, amend filed 06/28/2021, effective 07/01/2021 DHSD 5-2017, f. & cert. ef. 5-16-17 DHSD 4-2017(Temp), f. 5-11-17, cert. ef. 5-15-17 thru 11-10-17 Renumbered from 410-006-0021, DHSD 6-2007, f. 6-29-07, cert. ef. 7-1-07 OMAP 8-1999, f. & cert. ef. 3-1-99
407-014-0300 Scope These rules (OAR 407-014-0300 to 407-014-0320) apply to an organization or individual seeking or receiving access to Department information assets or network and information systems for the purpose of carrying out a business transaction between the Department and the user. (1) These rules are intended to complement, and not supersede, access control or security requirements in the Department’s Electronic Data Transmission rules, OAR 407-120-0100 to 407-120-0200, and whichever rule is more specific shall control. (2) The confidentiality of specific information and the conditions for use and disclosure of specific information are governed by other laws and rules, including but not limited to the Department’s rules for the privacy of protected information, OAR 407-014-0000 to 407-014-0070. Statutory/Other Authority: ORS 409.050 Statutes/Other Implemented: ORS 182.122 History: DHSD 1-2012, f. & cert. ef. 2-1-12 DHSD 6-2011(Temp), f. & cert. ef. 8-9-11 thru 2-2-12 DHSD 14-2007, f. 12-31-07, cert. ef. 1-1-08
407-014-0305 Definitions For purpose of these rules, the following terms have definitions set forth below. All other terms not defined in this section shall have the meaning used in the Health Insurance Portability and Accountability Act (HIPAA) security rules found at 45 CFR § 164.304: (1) “Access” means the ability or the means necessary to read, communicate, or otherwise use any Department information asset. (2) “Access control process” means Department forms and processes used to authorize a user, identify their job assignment, and determine the required access. (3) “Client records” means any client, applicant, or participant information regardless of the media or source, provided by the Department to the user, or exchanged between the Department and the user. (4) “Department” means the Department of Human Services. (5) “Incident” means the attempted or successful unauthorized access, use, disclosure, modification, or destruction of any network and information system or Department information asset including but not limited to unauthorized disclosure of information, failure to protect user’s identification (ID) provided by the Department, or theft of computer equipment that uses or stores any Department information asset. (6) “Information asset” means any information, also known as data, provided through the Department, regardless of the source or media, which requires measures for security and privacy of the information. (7) “Network and information system” means the State of Oregon’s computer infrastructure which provides personal communications, client records and other sensitive information assets, regional, wide area and local area networks, and the internetworking of various types of networks on behalf of the Department. (8) “Organization” means any entity authorized by the Department to access a network and information system or information asset. (9) “User” means any individual authorized by the Department to access a network and information system or information asset. Statutory/Other Authority: ORS 409.050 Statutes/Other Implemented: ORS 182.122 History: DHSD 1-2012, f. & cert. ef. 2-1-12 DHSD 6-2011(Temp), f. & cert. ef. 8-9-11 thru 2-2-12 DHSD 14-2007, f. 12-31-07, cert. ef. 1-1-08
407-014-0310 Information Access The organization or user shall utilize the Department access control process for all requested and approved access. The Department shall notify the user of each approval or denial. When approved, the Department shall provide the user with a unique login identifier to access the network and information system or information asset. The Department may authorize the use of a generic login identifier.. Statutory/Other Authority: ORS 409.050 Statutes/Other Implemented: ORS 182.122 History: DHSD 1-2012, f. & cert. ef. 2-1-12 DHSD 6-2011(Temp), f. & cert. ef. 8-9-11 thru 2-2-12 DHSD 14-2007, f. 12-31-07, cert. ef. 1-1-08
407-014-0315 Security Information Assets (1) No organization or user shall access an information asset for any purpose other than that specifically authorized by the Department access control process. (2) Except as specified or approved by the Department, no organization or user shall alter, delete, or destroy any information asset. (3) The organization shall prohibit unauthorized access by their staff, contractors, agents, or others to the network and information systems or Department information assets, and shall implement safeguards to prevent unauthorized access in accordance with section (4) of this rule. (4) The organization shall develop a security risk management plan. The organization shall ensure that the plan includes but is not limited to the following: (a) Administrative, technical, and physical safeguards commonly found in the International Standards Organization 27002: 2005 security standard or National Institute of Standards and Technology (NIST) 800 Series. (b) Standards established in accordance with HIPAA security rules, 45 CFR Parts 160 and 164, applicable to an organization or user regarding the security and privacy of a client record, any information asset, or network and information system. (c) The organization’s privacy and security policies. (d) Controls and safeguards that address the security of equipment and storage of any information asset accessed to prevent inadvertent destruction, disclosure, or loss. (e) Controls and safeguards that ensure the security of an information asset, regardless of the media, as identified below: (A) The user keeps Department-assigned access control requirements such as identification of authorized users and access control information (passwords and personal identification numbers (PINs)), in a secure location until access is terminated; (B) Upon request of the Department, the organization makes available all information about the user’s use or application of the access controlled network and information system or information asset; and (C) The organization or user ensures the proper handling, storage, and disposal of any information asset obtained or reproduced and, when the authorized use of that information ends, is consistent with any applicable record retention requirements. (f) Existing security plans developed to address other regulatory requirements, such as Sarbanes-Oxley Act of 2002 (PL 107-204), Title V of Gramm Leach Bliley Act of 1999, and Statement on Auditing Standards (SAS) number 70, will be deemed acceptable as long as they address the above requirements. (5) The Department may request additional information related to the organization’s security measures. (6) The organization or user must immediately notify the Department when access is no longer required and immediately cease access to or use of all information assets or network and information systems. Statutory/Other Authority: ORS 409.050 Statutes/Other Implemented: ORS 182.122 History: DHSD 1-2012, f. & cert. ef. 2-1-12 DHSD 6-2011(Temp), f. & cert. ef. 8-9-11 thru 2-2-12 DHSD 14-2007, f. 12-31-07, cert. ef. 1-1-08
407-014-0320 User Responsibility The organization or user shall not make any root level changes to any Department or State of Oregon network and information system. The Department recognizes that some application users have root level access to certain functions to allow the user to diagnose problems (such as startup or shutdown operations, disk layouts, user additions, deletions or modifications, or other operation) that require root privileges. This access does not give the user the right to make any changes normally restricted to root without explicit, written permission from the Department. (1) Use and disclosure of any Department information asset is strictly limited to the minimum information necessary to perform the requested and authorized service. (2) The organization shall have established privacy and security measures that meet or exceed the standards set forth in the Department’s privacy and information security policies, available from the Department, regarding the disclosure of an information asset. (3) The organization or user shall comply with all security and privacy federal and state laws, rules, and regulations applicable to the access granted. (4) The organization shall make the security risk plan available to the Department for review upon request. (5) The organization or user shall report to the Department all privacy or security incidents by the user that compromise, damage, or cause a loss of protection to Department information assets or network and information systems. The incident report shall be made no later than five business days from the date on which the user becomes aware of such incident. The user shall provide the Department a written report which must include the results of the incident assessment findings and resolution strategies. (6) Wrongful use of a network and information system or wrongful use or disclosure of a Department information asset by the organization or user may cause the immediate suspension or revocation of any access granted at the sole discretion of the Department without advance notice. (7) The organization or user shall comply with the Department’s request for corrective action concerning a privacy or security incident and with laws requiring mitigation of harm caused by the unauthorized use or disclosure of confidential information, if any. Statutory/Other Authority: ORS 409.050 Statutes/Other Implemented: ORS 182.122 History: DHSD 1-2012, f. & cert. ef. 2-1-12 DHSD 6-2011(Temp), f. & cert. ef. 8-9-11 thru 2-2-12 DHSD 14-2007, f. 12-31-07, cert. ef. 1-1-08