reglab/statecodes huggingface dataset:
Oregon Administrative Rules › Chapter 943 - OREGON HEALTH AUTHORITY › Division 14 - PRIVACY AND CONFIDENTIALITY › Section 943-014-0010 - Purpose

Current through Register Vol. 63, No. 7, July 1, 2024
(1) The
			 purpose of these rules (OAR 943-014-000 to 943-014-0070) is to govern
			 the collection, use, and disclosure of protected information by the
			 Authority about individuals and to explain the rights and specific
			 actions that individuals may take or request to be taken regarding
			 the uses and disclosures of their protected information. These rules
			 also set forth the Authority's requirements governing the use and
			 disclosure of PHI for purposes of HIPAA,
			 42 USC
			 1320 -d through 1320d-8, Pub L
			 104-191, sec. 262 and 264, and the implementing HIPAA privacy rules,
			 45 CFR parts 160 and 164, applicable to the Authority's health care
			 components.
(2) Except as
			 provided in section (1) of this rule, state and federal statutes,
			 rules, and policies that govern the administration of Authority
			 programs, services, and activities continue to govern the use and
			 disclosure of protected information in those Authority programs,
			 services, and activities.
(3) In the event that it is not
			 possible to comply with the requirements of both sections (1) and (2)
			 of this rule, the Authority shall act in accordance with whichever
			 federal or state law imposes a stricter requirement regarding the
			 privacy or safeguarding of information and which provides the greater
			 protection or access to the individual who is the subject of the
			 information, unless one of the following applies:
(a) Public health. Nothing in these
			 rules shall be construed to invalidate or limit the authority, power,
			 or procedures established under any law providing for the reporting
			 of disease or injury, birth, or death; public health surveillance; or
			 public health investigation or intervention.
(b) Child abuse. Nothing in these
			 rules shall be construed to invalidate or limit the authority, power,
			 or procedures established under any law providing for the reporting
			 of child abuse.
(c) State
			 regulatory reporting. Nothing in these rules shall be construed to
			 limit the ability of the State of Oregon or the Authority to require
			 a health plan to report, or to provide access to information for
			 management audits, financial audits, program monitoring, facility
			 licensure or certification, or individual licensure or
			 certification.
Oregon Administrative Rules › Chapter 943 - OREGON HEALTH AUTHORITY › Division 14 - PRIVACY AND CONFIDENTIALITY › Section 943-014-0015 - Covered Entity Status for Purposes of the HIPAA Privacy Rules

Current through Register Vol. 63, No. 7, July 1, 2024
(1) These
			 rules address information that, among other things, may be Protected
			 Health Information that is protected by the HIPAA Privacy Rules. For
			 purposes of HIPAA Privacy Rules, the Authority is a hybrid entity
			 because the Authority performs functions that are covered by HIPAA
			 ("health care components") and functions that are not covered by
			 HIPAA. The Authority's health care components consist of the
			 functions that are included in the definition of a covered entity, as
			 follows:
(a) The Authority in its
			 capacity as the state Medicaid agency for the administration of the
			 Medicaid program under Title XIX of the Social Security Act and the
			 Children's Health Insurance Program under Title XXI of the Act and
			 the medical assistance program as described in ORS chapter
			 414.
(b) The Health Care
			 for All Oregon Children program;
(c) The Family Health Insurance
			 Assistance Program established in ORS
			 414.841 to
			 414.864;
(d) Any medical assistance or
			 premium assistance programs reimbursed with Medicaid or the
			 Children's Health Insurance Program funds operated by the
			 Authority;
(e) The Oregon
			 State Hospital and Blue Mountain Recovery Center;
(f) The high risk pools
			 administered by the Oregon Medical Insurance Pool Board and the
			 Office of Private Health Partnerships;
(g) The Breast and Cervical Cancer
			 Program and the Wise Woman Program;
(h) The Public Health
			 Laboratory;
(i) The
			 Medicaid Management Information system and information technology
			 systems associated with the administration and management of the
			 health care components listed above; and
(j) The ombudsman and other
			 administrative and health care operations functions associated with
			 the administration and management of the health care components
			 listed above.
Oregon Administrative Rules › Chapter 943 - OREGON HEALTH AUTHORITY › Division 14 - PRIVACY AND CONFIDENTIALITY › Section 943-014-0020 - Uses and Disclosures of Client or Participant Protected Information

Current through Register Vol. 63, No. 7, July 1, 2024
(1) Uses and disclosures with
			 individual authorization. The Authority must obtain a completed and
			 signed authorization for release of information from the individual,
			 or the individual's personal representative, before obtaining or
			 using protected information about an individual from a third party or
			 disclosing protected information about the individual to a third
			 party.
(a) Uses and disclosures
			 must be consistent with what the individual has approved on the
			 signed authorization form approved by the Authority.
(b) An individual may revoke an
			 authorization at any time. The revocation must be in writing and
			 signed by the individual, except that substance abuse treatment
			 patients may orally revoke an authorization to disclose information
			 obtained from substance abuse treatment programs. No revocation shall
			 apply to information already released while the authorization was
			 valid and in effect.
Oregon Administrative Rules › Chapter 943 - OREGON HEALTH AUTHORITY › Division 14 - PRIVACY AND CONFIDENTIALITY › Section 943-014-0040 - Minimum Necessary Standards

Current through Register Vol. 63, No. 7, July 1, 2024
(1) The Authority shall limit the
			 use and disclosure of protected information to that which is
			 reasonably necessary to accomplish the intended purpose of the use or
			 disclosure which is referred to in these rules as the minimum
			 necessary standard.
(2)
			 This minimum necessary standard is not intended to impede the
			 essential Authority activities of treatment, payment, health care
			 operations, or service delivery.
(3) The minimum necessary standard
			 applies:
(a) When using protected
			 information within the Authority;
(b) When disclosing protected
			 information to a third party in response to a request; or
(c) When requesting protected
			 information from another covered entity.
Oregon Administrative Rules › Chapter 943 - OREGON HEALTH AUTHORITY › Division 14 - PRIVACY AND CONFIDENTIALITY › Section 943-014-0060 - Uses and Disclosures of Protected Information for Research Purposes

Current through Register Vol. 63, No. 7, July 1, 2024
The Authority may use and disclose an individual's
				information for research purposes as specified in this rule.
(1) All research disclosures are
			 subject to applicable requirements of federal and state laws and
			 rules including but not limited to  45 CFR part 46  and 21 CFR part
			 50.0 to 50.56, relating to the protection of human research
			 subjects.
(2) The
			 Authority may use and disclose de-identified information or a limited
			 data set for research purposes, pursuant to OAR
			 943-014-0070.
(3) The
			 Authority may use and disclose information regarding an individual
			 for research purposes with the specific written authorization of the
			 individual. The authorization must meet all requirements in OAR
			 943-014-0030, and may indicate an expiration date with terms such as
			 "end of research study" or similar language. An authorization for use
			 and disclosure for a research study may be combined with other types
			 of written authorization for the same research study. If research
			 includes treatment, the researcher may require an authorization for
			 use and disclosure for the research as a provision of providing
			 research related treatment.
(4) Notwithstanding section (3) of
			 this rule, the Authority may use and disclose an individual's
			 information for research purposes without the individual's written
			 authorization, regardless of the source of funding for the research,
			 provided that:
(a) The Authority
			 obtains documentation that a waiver of an individual's authorization
			 for release of information requirements has been approved by an IRB
			 registered with the Office for Human Research Protection.
			 Documentation required of an IRB when granting approval of a waiver
			 of an individual's authorization for release of information must
			 include all criteria specified in 45 CFR part
			 164.512(i)(2).
(b) A
			 researcher may request access to individual information maintained by
			 the Authority in preparation for research or to facilitate the
			 development of a research protocol in anticipation of research. The
			 Authority may determine whether to permit such use or disclosure,
			 without individual authorization or use of an IRB, pursuant to  45 CFR
			 part 164.512(i)(1)(ii).
(c) A researcher may request access
			 to individual information maintained by the Authority about deceased
			 individuals. The Authority may determine whether to permit such use
			 or disclosure of information about decedents, without individual
			 authorization or use of an IRB, pursuant to 45 CFR part
			 164.512(i)(1)(iii).
Oregon Administrative Rules › Chapter 943 - OREGON HEALTH AUTHORITY › Division 14 - PRIVACY AND CONFIDENTIALITY › Section 943-014-0070 - De-identification of Client Information and Use of Limited Data Sets under Data Use Agreements

Current through Register Vol. 63, No. 7, July 1, 2024
(1) The Authority may use and
			 disclose information as appropriate for the work of the Authority,
			 without further restriction, if the Authority or another entity has
			 taken steps to de-identify the information pursuant to 45 CFR part
			 164.514(a) and (b).
(2)
			 The Authority may assign a code or other means of record
			 identification to allow the Authority to re-identify the
			 de-identified information provided that:
(a) The code or other means of
			 record identification is not derived from or related to information
			 about the individual and cannot otherwise be translated to identify
			 the individual; and,
(b)
			 The Authority does not use or disclose the code or other means of
			 record identification for any other purpose, and does not disclose
			 the mechanism for re-identification.
Oregon Administrative Rules › Chapter 943 - OREGON HEALTH AUTHORITY › Division 14 - PRIVACY AND CONFIDENTIALITY › Section 943-014-0200 - Confidentiality and Inadmissibility of Mediation Communications

Current through Register Vol. 63, No. 7, July 1, 2024
Pursuant to ORS
				36.224(4),
				amending the Oregon Health Authority rule Confidentiality and
				Mediation Communications 943-014-0200  to adopt by reference the
				Confidentiality and Inadmissibility of Mediation Communications rule
				OAR 137-005-0052  adopted by the Attorney General effective as of
				10-27-15.
Forms referenced are available from the
				  agency.
Stat. Auth.: ORS
				  326.051
Stats. Implemented: ORS
				  36.224,
				  36.228,
				  36.230,
				  36.232, OL 2015, ch
				  114 (SB 189)
Oregon Administrative Rules › Chapter 943 - OREGON HEALTH AUTHORITY › Division 14 - PRIVACY AND CONFIDENTIALITY › Section 943-014-0205 - Confidentiality and Inadmissibility of Workplace Interpersonal Dispute Mediation Communications

Current through Register Vol. 63, No. 7, July 1, 2024
Pursuant to ORS
				36.224(4),
				adopting the Oregon Health Authority rule Confidentiality and
				Inadmissibility of Workplace Interpersonal Dispute Mediation
				Communications 943-014-0205  to adopt by reference the Confidentiality
				and Inadmissibility of Workplace Interpersonal Mediation
				Communications rule OAR 137-005-0054  adopted by the Attorney General
				effective as of 10-27-15.
Stat. Auth.: ORS
				  36.224, OL 2015, ch
				  114 (SB 189)
Stats. Implemented: ORS
				  36.230(4),
				  OL 2015, ch 114 (SB 189)
Oregon Administrative Rules › Chapter 943 - OREGON HEALTH AUTHORITY › Division 14 - PRIVACY AND CONFIDENTIALITY › Section 943-014-0300 - Scope

Current through Register Vol. 63, No. 7, July 1, 2024
These rules (OAR 943-014-0300  through 943-014-0320)
				apply to an organization or individual seeking or receiving access to
				Authority information assets or network and information systems for
				the purpose of carrying out a business transaction between the
				Authority and the user.
(1)
			 These rules are intended to complement, and not supersede, access
			 control or security requirements in the Authority's Electronic Data
			 Transmission rules, OAR 943-120-0100  to 943-120-0200, and whichever
			 rule is more specific shall control.
(2) The confidentiality of specific
			 information and the conditions for use and disclosure of specific
			 information are governed by other laws and rules, including but not
			 limited to the Authority's rules for the privacy of protected
			 information, OAR 943-014-0000  to 943-014-0070.
Stat. Auth.: ORS
				  413.042
Stats. Implemented: ORS
				  182.122
Oregon Administrative Rules › Chapter 943 - OREGON HEALTH AUTHORITY › Division 14 - PRIVACY AND CONFIDENTIALITY › Section 943-014-0305 - Definitions

Current through Register Vol. 63, No. 7, July 1, 2024
For purpose of these rules, the following terms have
				definitions set forth below. All other terms not defined in this
				section shall have the meaning used in the Health Insurance
				Portability and Accountability Act (HIPAA) security rules found at 45
				CFR ¦ 164.304:
(1)
			 "Access" means the ability or the means necessary to read,
			 communicate, or otherwise use any Authority information
			 asset.
(2) "Access
			 Control Process" means Authority forms and processes used to
			 authorize a user, identify their job assignment, and determine the
			 required access.
(3)
			 "Authority" means the Oregon Health Authority.
(4) "Client Records" means any
			 client, applicant, or participant information regardless of the media
			 or source, provided by the Authority to the user, or exchanged
			 between the Authority and the user.
(5) "Incident" means the attempted
			 or successful unauthorized access, use, disclosure, modification, or
			 destruction of any network and information system or Authority
			 information asset including, but not limited to unauthorized
			 disclosure of information; failure to protect user's identification
			 (ID) provided by the Authority; or, theft of computer equipment that
			 uses or stores any Authority information asset.
(6) "Information Asset" means any
			 information, also known as data, provided through the Authority,
			 regardless of the source or media, which requires measures for
			 security and privacy of the information.
(7) "Network and Information
			 System" means the State of Oregon's computer infrastructure, which
			 provides personal communications, client records and other sensitive
			 information assets, regional, wide area and local area networks, and
			 the internetworking of various types of networks on behalf of the
			 Authority.
(8) "User"
			 means any individual authorized by the Authority to access a network
			 and information system or information asset.
(9) "Organization" means any entity
			 authorized by the Authority to access a network and information
			 system or information asset.
Stat. Auth.: ORS
				  413.042
Stats. Implemented: ORS
				  182.122
Oregon Administrative Rules › Chapter 943 - OREGON HEALTH AUTHORITY › Division 14 - PRIVACY AND CONFIDENTIALITY › Section 943-014-0310 - Information Access

Current through Register Vol. 63, No. 7, July 1, 2024
The organization or user shall utilize the Authority
				access control process for all requested and approved access. The
				Authority shall notify the user of each approval or denial. When
				approved, the Authority shall provide the user with a unique login
				identifier to access the network and information system or
				information asset. The Authority may authorize the use of a generic
				login identifier.
Stat. Auth.: ORS
				  413.042
Stats. Implemented: ORS
				  182.122
Oregon Administrative Rules › Chapter 943 - OREGON HEALTH AUTHORITY › Division 14 - PRIVACY AND CONFIDENTIALITY › Section 943-014-0315 - Security Information Assets

Current through Register Vol. 63, No. 7, July 1, 2024
(1) No organization or user shall
			 access an information asset for any purpose other than that
			 specifically authorized by the Authority access control
			 process.
(2) Except as
			 specified or approved by the Authority, no organization or user shall
			 alter, delete, or destroy any information asset.
(3) The organization shall prohibit
			 unauthorized access by their staff, contractors, agents, or others to
			 the network and information systems, or Authority information assets,
			 and shall implement safeguards to prevent unauthorized access in
			 accordance with section (4) of this rule.
(4) The organization shall develop
			 a security risk management plan. The organization shall ensure that
			 the plan includes, but is not limited to the following:
(a) Administrative, technical, and
			 physical safeguards commonly found in the International Standards
			 Organization 27002: 2005 security standard or National Institute of
			 Standards and Technology (NIST) 800 Series;
(b) Standards established in
			 accordance with HIPAA Security Rules, 45 CFR Parts 160 and 164,
			 applicable to an organization or user regarding the security and
			 privacy of a client record, any information asset, or network and
			 information system;
(c)
			 The organization's privacy and security policies;
(d) Controls and safeguards that
			 address the security of equipment and storage of any information
			 asset accessed to prevent inadvertent destruction, disclosure, or
			 loss;
(e) Controls and
			 safeguards that ensure the security of an information asset,
			 regardless of the media, as identified below:
(A) The user keeps
			 Authority-assigned access control requirements such as identification
			 of authorized users and access control information (passwords and
			 personal identification numbers (PIN's)), in a secure location until
			 access is terminated;
(B)
			 Upon request of the Authority, the organization makes available all
			 information about the user's use or application of the access
			 controlled network and information system or information asset;
			 and
(C) The organization
			 or user ensures the proper handling, storage, and disposal of any
			 information asset obtained or reproduced, and, when the authorized
			 use of that information ends, is consistent with any applicable
			 record retention requirements.
(f) Existing security plans
			 developed to address other regulatory requirements, such as
			 Sarbanes-Oxley Act of 2002 (PL
			 107-204), Title V of Gramm Leach Bliley
			 Act of 1999, Statement on Auditing Standards (SAS) number 70, will be
			 deemed acceptable as long as they address the above
			 requirements.
Oregon Administrative Rules › Chapter 943 - OREGON HEALTH AUTHORITY › Division 14 - PRIVACY AND CONFIDENTIALITY › Section 943-014-0320 - User Responsibility

Current through Register Vol. 63, No. 7, July 1, 2024
The organization or user shall not make any root
				level changes to any Authority or State of Oregon network and
				information system. The Authority recognizes that some application
				users have root level access to certain functions to allow the user
				to diagnose problems (such as startup or shutdown operations, disk
				layouts, user additions, deletions or modifications, or other
				operation) that require root privileges. This access does not give
				the user the right to make any changes normally restricted to root
				without explicit written permission from the Authority.
(1) Use and disclosure of any
			 Authority information asset is strictly limited to the minimum
			 information necessary to perform the requested and authorized
			 service.
(2) The
			 organization shall have established privacy and security measures
			 that meet or exceed the standards set forth in the Authority privacy
			 and information security policies, available from the Authority,
			 regarding the disclosure of an information asset.
(3) The organization or user shall
			 comply with all security and privacy federal and state laws, rules,
			 and regulations applicable to the access granted.
(4) The organization shall make the
			 security risk plan available to the Authority for review upon
			 request.
(5) The
			 organization or user shall report to the Authority all privacy or
			 security incidents by the user that compromise, damage, or cause a
			 loss of protection to the Authority information assets or the network
			 and information systems. The incident report shall be made no later
			 than five business days from the date on which the user becomes aware
			 of such incident. The user shall provide the Authority a written
			 report which must include the results of the incident assessment
			 findings and resolution strategies.
(6) Wrongful use of a network and
			 information system, or wrongful use or disclosure of an Authority
			 information asset by the organization or user may cause the immediate
			 suspension or revocation of any access granted, at the sole
			 discretion of the Authority without advance notice.
(7) The organization or user shall
			 comply with the Authority's request for corrective action concerning
			 a privacy or security incident and with laws requiring mitigation of
			 harm caused by the unauthorized use or disclosure of confidential
			 information, if any.
Stat. Auth.: ORS
				  413.042
Stats. Implemented: ORS
				  182.122
Oregon Administrative Rules › Chapter 943 - OREGON HEALTH AUTHORITY › Division 14 - PRIVACY AND CONFIDENTIALITY › Section 943-014-0400 - Purpose

Current through Register Vol. 63, No. 7, July 1, 2024
These rules set requirements for contractors who are
				business associates of the health care component of the Oregon Health
				Authority (Authority) as described in OAR 943-014-0015. Business
				associates must comply with these rules, the business associate
				provisions of the Health Insurance Portability and Accountability Act
				(HIPAA) and HIPAA's implementing regulations. HIPAA requires covered
				entities to comply with the requirements set forth in
				45
				CFR 164.502(e) and
				164.504(e)
				by obtaining certain written assurances from the business associates.
Stat. Auth.: ORS
				  413.042
Stats. Implemented: ORS
				  179.505,
				  192.553,
				  192.556 -
				  192.581,
				  413.032,
				  413.042 &
				  414.065
Oregon Administrative Rules › Chapter 943 - OREGON HEALTH AUTHORITY › Division 14 - PRIVACY AND CONFIDENTIALITY › Section 943-014-0410 - Definitions

Current through Register Vol. 63, No. 7, July 1, 2024
As used in OAR 943-014-0400  through 943-014-0465  the
				following definitions apply. Terms not defined here shall have the
				same meaning given those terms in the Privacy Rule and the Security
				Rule,  45 CFR 160 and 164 .
(1) "Authority" means the Oregon
			 Health Authority.
(2)
			 "Breach" has the meaning given that term in
			 45 CFR
			 164.402.
(3) "Business associate" has the
			 meaning given that term in
			 45 CFR
			 160.103.
(4) "Contract" means the written
			 agreement between the Authority and a contractor describing the
			 rights and obligations of the parties.
(5) "Covered entity" has the
			 meaning given that term in
			 45 CFR
			 160.103.
(6) "Electronic media" means:
(a) Data stored in electronic
			 format; and
(b)
			 Transmission media used to exchange information already stored in
			 electronic format.
Oregon Administrative Rules › Chapter 943 - OREGON HEALTH AUTHORITY › Division 14 - PRIVACY AND CONFIDENTIALITY › Section 943-014-0420 - Uses and Disclosures of Protected Health Information by Business Associate

Current through Register Vol. 63, No. 7, July 1, 2024
(1) Except as otherwise limited or
			 prohibited by the contract or these rules, a contractor who is a
			 business associate of the Authority may:
(a) Use or disclose protected
			 health information and electronic protected health information to
			 perform functions, activities, or services as specified in the
			 contract and these rules on behalf of the Authority.
(b) Use protected health
			 information and electronic protected health information for the
			 proper management and administration of the business associate
			 contract or to carry out the business associate's legal
			 responsibilities.
(c)
			 Disclose protected health information and electronic protected health
			 information for the proper management and administration of the
			 business associate, provided disclosures are required by law.
(d) Disclose protected
			 health information and electronic protected health information to a
			 subcontractor if the business associate and subcontractor enter into
			 a business associate agreement that complies with this rule.
(e) Use or disclose
			 protected health information and electronic protected health
			 information to report violations of law to appropriate federal and
			 state authorities, consistent with
			 45
			 CFR 164.502(j)(1).
Oregon Administrative Rules › Chapter 943 - OREGON HEALTH AUTHORITY › Division 14 - PRIVACY AND CONFIDENTIALITY › Section 943-014-0430 - Authority Obligations

Current through Register Vol. 63, No. 7, July 1, 2024
(1) To the extent that a business
			 associate's use or disclosure of protected health information and
			 electronic protected health information may be affected, the
			 Authority shall notify business associate of:
(a) Limitations in its notice of
			 privacy practices in accordance with
			 45
			 CFR 164.520. The Authority may
			 satisfy this obligation by providing business associate with the
			 Authority's most current Notices of Privacy Practices.
(b) Changes in, or revocation of,
			 permission by an individual to use or disclose protected health
			 information or electronic protected health information.
(c) Restrictions to the use or
			 disclosure of protected health information or electronic protected
			 health information that the Authority has agreed to in accordance
			 with
			 45
			 CFR 164.522.
Oregon Administrative Rules › Chapter 943 - OREGON HEALTH AUTHORITY › Division 14 - PRIVACY AND CONFIDENTIALITY › Section 943-014-0435 - Contractor Security Requirements

Current through Register Vol. 63, No. 7, July 1, 2024
(1) Contractors must comply with
			 the Security Rule's business associate requirements for electronic
			 protected health information and must comply with both the Privacy
			 Rule and the Security Rule requirements applicable to a business
			 associate.
(2)
			 Contractors must:
(a) Implement
			 administrative, physical, and technical safeguards that reasonably
			 and appropriately protect the confidentiality, integrity, and
			 availability of the protected health information and electronic
			 protected health information that it creates, receives, maintains, or
			 transmits on behalf of the Authority.
(b) Develop and enforce policies,
			 procedures, and documentation standards (including designation of a
			 security official) related to the administrative, physical, and
			 technical safeguards that protect electronic protected health
			 information.
(c) When
			 required by OAR 943-014-0415(5), enter into a business associate
			 agreement with any agent or subcontractor to ensure the agent or
			 subcontractor agrees to implement reasonable and appropriate
			 safeguards to protect electronic protected health information the
			 contractor provides.
Oregon Administrative Rules › Chapter 943 - OREGON HEALTH AUTHORITY › Division 14 - PRIVACY AND CONFIDENTIALITY › Section 943-014-0440 - Breach

Current through Register Vol. 63, No. 7, July 1, 2024
(1) For
			 the purposes of this rule a breach is considered "discovered" in
			 accordance with
			 45 CFR
			 164.404(a)(2) and
			 45 CFR
			 164.410(2).
(2) In the event a
			 breach of unsecured protected health information is discovered, a
			 contractor must:
(a) Notify the
			 Authority of the breach.
(A) The
			 notification must be made as soon as possible and business associate
			 shall confer with the Authority as soon as practicable thereafter.
(B) The notification
			 must be made to the Authority no later than 30 calendar days after
			 the discovery of breach.
(C) Notification shall include
			 identification of each individual whose unsecured protected health
			 information has been, or is reasonably believed to have been
			 accessed, acquired, or disclosed during the breach.
(D) Notification shall include
			 steps taken to mitigate harm, steps taken to reasonably ensure a like
			 breach will not occur in the future, and any other information that
			 may be reasonably required by the Authority for the Authority to meet
			 its obligations.
Oregon Administrative Rules › Chapter 943 - OREGON HEALTH AUTHORITY › Division 14 - PRIVACY AND CONFIDENTIALITY › Section 943-014-0445 - Violations

Current through Register Vol. 63, No. 7, July 1, 2024
(1) When
			 the Authority learns about a business associate's failure to comply
			 with these rules the Authority shall notify the business associate of
			 the rule violation and provide a reasonable opportunity for the
			 business associate to remedy or end the violation.
(2) The Authority may terminate the
			 contract if business associate does not cure the breach or end the
			 violation within the time specified by the Authority.
(3) The Authority shall immediately
			 terminate the contract if business associate has violated these rules
			 and remedy is not possible in the Authority's reasonable
			 judgment.
Stat. Auth.: ORS
				  413.042
Stats. Implemented: ORS
				  179.505,
				  192.553,
				  192.556 -
				  192.581,
				  413.032,
				  413.042 &
				  414.065
Oregon Administrative Rules › Chapter 943 - OREGON HEALTH AUTHORITY › Division 14 - PRIVACY AND CONFIDENTIALITY › Section 943-014-0450 - Termination of Contract

Current through Register Vol. 63, No. 7, July 1, 2024
(1) Except as provided in section
			 (2) of this rule, upon termination of the contract for any reason,
			 the business associate shall, at the request of the Authority, return
			 or destroy all protected health information and electronic protected
			 health information created, maintained or received by the business
			 associate from the Authority or on the Authority's behalf.
(a) This section shall apply to
			 protected health information and electronic protected health
			 information that is in the possession of subcontractors or agents of
			 the business associate.
(b) Business associate may not
			 retain copies of the protected health information and electronic
			 protected health information.
Oregon Administrative Rules › Chapter 943 - OREGON HEALTH AUTHORITY › Division 14 - PRIVACY AND CONFIDENTIALITY › Section 943-014-0455 - Order of Precedence

Current through Register Vol. 63, No. 7, July 1, 2024
(1) These rules shall be
			 interpreted as broadly as necessary to implement and comply with
			 HIPAA, the Privacy Rule, the Security Rule, and the HITECH Act.
(2) Any ambiguity in
			 these rules shall be resolved in favor of a meaning that complies and
			 is consistent with HIPAA, the Privacy Rule, the Security Rule, and
			 the HITECH Act.
(3) Any
			 ambiguity in the contract shall be resolved to permit the Authority
			 and business associate to implement and comply with HIPAA, the HITECH
			 Act, the Privacy Rule and the Security Rule.
(4) If a conflict arises between
			 these rules and the provisions of the contract, these rules shall
			 control.
(5) If a
			 conflict arises between the provisions of the contract and the
			 Privacy Rule, the Security Rule, or the HITECH Act, the Privacy Rule,
			 the Security Rule, and the HITECH Act shall control.
(6) If conflict arises between
			 these rules and the Privacy Rule, Security Rule, or HITECH Act, the
			 Privacy Rule, Security Rule, and the HITECH Act shall control.
(7) These rules shall
			 not supersede any other federal or state law or regulation governing
			 the legal relationship of the parties, or the confidentiality of
			 records or information, except to the extent that HIPAA and the
			 HITECH Act preempt those laws or regulations.
Stat. Auth.: ORS
				  413.042
Stats. Implemented: ORS
				  179.505,
				  192.553,
				  192.556 -
				  192.581,
				  413.032,
				  413.042 &
				  414.065
Oregon Administrative Rules › Chapter 943 - OREGON HEALTH AUTHORITY › Division 14 - PRIVACY AND CONFIDENTIALITY › Section 943-014-0460 - Authority Compliance Methods

Current through Register Vol. 63, No. 7, July 1, 2024
The Authority may comply with these rules:
(1) By incorporating the business
			 associate requirements contained in this rule into its contracts with
			 business associates or by referencing these rules.
(2) By entering into a memorandum
			 of understanding that accomplishes the objectives of these rules and
			 meets the business associate requirements of the Privacy Rule and
			 Security Rule, if the business associate is a government entity.
(3) By executing an
			 amendment or rider that contains the contract provisions required by
			 these rules or references to these rules and that amends the
			 Authority's contract with the business associate.
Stat. Auth.: ORS
				  413.042
Stats. Implemented: ORS
				  179.505,
				  192.553,
				  192.556 -
				  192.581,
				  413.032,
				  413.042 &
				  414.065
Oregon Administrative Rules › Chapter 943 - OREGON HEALTH AUTHORITY › Division 14 - PRIVACY AND CONFIDENTIALITY › Section 943-014-0465 - Standards in Individual Contracts

Current through Register Vol. 63, No. 7, July 1, 2024
(1) The Authority and a business
			 associate may enter into a contract that contains more strict
			 standards than those set forth in these rules as long as the
			 standards do not violate the requirements of the Privacy Rule,
			 Security Rule, or the HITECH Act, and the contract receives approval
			 from the Oregon Department of Justice.
(2) If the Authority and a business
			 associate enter into a contract containing more strict standards than
			 those set forth in these rules, the business associate shall require
			 subcontractors who are business associates to comply with the
			 stricter standards.
Stat. Auth.: ORS
				  413.042
Stats. Implemented: ORS
				  179.505,
				  192.553,
				  192.556 -
				  192.581,
				  413.032,
				  413.042 &
				  414.065
Oregon Administrative Rules › Chapter 943 - OREGON HEALTH AUTHORITY › Division 21 - Renumbered › Section 943-021-0001 - Renumbered

Current through Register Vol. 63, No. 7, July 1, 2024
Statutory/Other Authority: SB 70 (2021) & ORS
				  413.042
Statutes/Other Implemented: SB 70
				  (2021)
Oregon Administrative Rules › Chapter 943 - OREGON HEALTH AUTHORITY › Division 21 - Renumbered › Section 943-021-0005 - Renumbered

Current through Register Vol. 63, No. 7, July 1, 2024
Statutory/Other Authority: SB 70 (2021) & ORS
				  413.042
Statutes/Other Implemented: SB 70
				  (2021)
Oregon Administrative Rules › Chapter 943 - OREGON HEALTH AUTHORITY › Division 45 - ABUSE INVESTIGATIONS AND SAFETY › Section 943-045-0000 - Adult Abuse Investigations, Assessing Protective Services and Review of Abuse Findings for Mental Health Services

Current through Register Vol. 63, No. 7, July 1, 2024
The standards and procedures for the investigation of abuse,
				assessment for protective services and review of abuse findings are available
				at OAR chapter 419 as follows.
(1)  Effective September 1, 2017 for adult community mental
				health programs and mental health residential treatment services, including
				adult foster homes, in OAR chapter 419, division 110.
(2)  Effective April 13, 2018 for the state hospitals in OAR
				chapter 419, division 120.
(3)  Effective March 1, 2019 for requesting a contested case
				hearing in OAR 419-050-0000  and use of lay representatives in OAR
				419-050-0010.
(4)  Effective January 1, 2020 for adult residential treatment
				services for a substance use disorder and recovery, and Oregon Department of
				Human Services review of substantiated abuse findings in OAR chapter 419,
				division 130.
Statutory/Other Authority: ORS 179.040 & 413.042
Statutes/Other Implemented: ORS 179.390, 426.385, 427.031,
				  430.210 & 430.731 to 430.768
Oregon Administrative Rules › Chapter 943 - OREGON HEALTH AUTHORITY › Division 45 - ABUSE INVESTIGATIONS AND SAFETY › Section 943-045-0250

Current through Register Vol. 63, No. 7, July 1, 2024
Stat. Authority: ORS
				  179.040 &
				  413.042,
				  414.715 &
				  430.731
Stats. Implemented: ORS
				  413.032,
				  430.735-430.765,
				  443.400 -
				  443.460,
				  443.705 -
				  443.825
Oregon Administrative Rules › Chapter 943 - OREGON HEALTH AUTHORITY › Division 45 - ABUSE INVESTIGATIONS AND SAFETY › Section 943-045-0260

Current through Register Vol. 63, No. 7, July 1, 2024
Stat. Authority: ORS
				  179.040 &
				  413.042,
				  414.715 &
				  430.731
Stats. Implemented: ORS
				  413.032,
				  430.735-430.765,
				  443.400 -
				  443.460,
				  443.705 -
				  443.825
Oregon Administrative Rules › Chapter 943 - OREGON HEALTH AUTHORITY › Division 45 - ABUSE INVESTIGATIONS AND SAFETY › Section 943-045-0280

Current through Register Vol. 63, No. 7, July 1, 2024
Stat. Authority: ORS
				  179.040 &
				  413.042,
				  414.715 &
				  430.731
Stats. Implemented: ORS
				  413.032,
				  430.735-430.765,
				  443.400 -
				  443.460,
				  443.705 -
				  443.825
Oregon Administrative Rules › Chapter 943 - OREGON HEALTH AUTHORITY › Division 45 - ABUSE INVESTIGATIONS AND SAFETY › Section 943-045-0290

Current through Register Vol. 63, No. 7, July 1, 2024
Stat. Authority: ORS
				  179.040 &
				  413.042,
				  414.715 &
				  430.731
Stats. Implemented: ORS
				  413.032,
				  430.735-430.765,
				  443.400 -
				  443.460,
				  443.705 -
				  443.825
Oregon Administrative Rules › Chapter 943 - OREGON HEALTH AUTHORITY › Division 45 - ABUSE INVESTIGATIONS AND SAFETY › Section 943-045-0300

Current through Register Vol. 63, No. 7, July 1, 2024
Stat. Authority: ORS
				  179.040 &
				  413.042,
				  414.715 &
				  430.731
Stats. Implemented: ORS
				  413.032,
				  430.735-430.765,
				  443.400 -
				  443.460,
				  443.705 -
				  443.825
Oregon Administrative Rules › Chapter 943 - OREGON HEALTH AUTHORITY › Division 45 - ABUSE INVESTIGATIONS AND SAFETY › Section 943-045-0310

Current through Register Vol. 63, No. 7, July 1, 2024
Stat. Authority: ORS
				  179.040 &
				  413.042,
				  414.715 &
				  430.731
Stats. Implemented: ORS
				  413.032,
				  430.735-430.765,
				  443.400 -
				  443.460,
				  443.705 -
				  443.825
Oregon Administrative Rules › Chapter 943 - OREGON HEALTH AUTHORITY › Division 45 - ABUSE INVESTIGATIONS AND SAFETY › Section 943-045-0320

Current through Register Vol. 63, No. 7, July 1, 2024
Stat. Authority: ORS
				  179.040 &
				  413.042,
				  414.715 &
				  430.731
Stats. Implemented: ORS
				  413.032,
				  430.735-430.765,
				  443.400 -
				  443.460,
				  443.705 -
				  443.825
Oregon Administrative Rules › Chapter 943 - OREGON HEALTH AUTHORITY › Division 45 - ABUSE INVESTIGATIONS AND SAFETY › Section 943-045-0330

Current through Register Vol. 63, No. 7, July 1, 2024
Stat. Authority: ORS
				  179.040 &
				  413.042,
				  414.715 &
				  430.731
Stats. Implemented: ORS
				  413.032,
				  430.735-430.765,
				  443.400 -
				  443.460,
				  443.705 -
				  443.825
Oregon Administrative Rules › Chapter 943 - OREGON HEALTH AUTHORITY › Division 45 - ABUSE INVESTIGATIONS AND SAFETY › Section 943-045-0340

Current through Register Vol. 63, No. 7, July 1, 2024
Stat. Auth.: ORS
				  179.040 &
				  413.042,
				  414.715 &
				  430.731
Stats. Implemented: ORS
				  413.032,
				  430.735-430.765,
				  443.400 -
				  443.460,
				  443.705 -
				  443.825
Oregon Administrative Rules › Chapter 943 - OREGON HEALTH AUTHORITY › Division 45 - ABUSE INVESTIGATIONS AND SAFETY › Section 943-045-0350

Current through Register Vol. 63, No. 7, July 1, 2024
Stat. Auth.: ORS
				  179.040 &
				  413.042,
				  414.715 &
				  430.731
Stats. Implemented: ORS
				  413.032,
				  430.735-430.765,
				  443.400 -
				  443.460,
				  443.705 -
				  443.825
Oregon Administrative Rules › Chapter 943 - OREGON HEALTH AUTHORITY › Division 45 - ABUSE INVESTIGATIONS AND SAFETY › Section 943-045-0360

Current through Register Vol. 63, No. 7, July 1, 2024
Stat. Auth.: ORS
				  179.040 &
				  413.042,
				  414.715 &
				  430.731
Stats. Implemented: ORS
				  413.032,
				  430.735-430.765,
				  443.400 -
				  443.460,
				  443.705 -
				  443.825
Oregon Administrative Rules › Chapter 943 - OREGON HEALTH AUTHORITY › Division 45 - ABUSE INVESTIGATIONS AND SAFETY › Section 943-045-0370

Current through Register Vol. 63, No. 7, July 1, 2024
Stat. Auth.: ORS
				  179.040 &
				  413.042,
				  414.715 &
				  430.731
Stats. Implemented: ORS
				  413.032,
				  430.735-430.765,
				  443.400 -
				  443.460,
				  443.705 -
				  443.825
Oregon Administrative Rules › Chapter 943 - OREGON HEALTH AUTHORITY › Division 45 - ABUSE INVESTIGATIONS AND SAFETY › Section 943-045-0400

Current through Register Vol. 63, No. 7, July 1, 2024
Stat. Auth.: ORS
				  179.040,
				  413.042
Stats. Implemented: ORS
				  179.390,
				  426.385,
				  427.031,
				  430.210,
				  430.735-430.768
Oregon Administrative Rules › Chapter 943 - OREGON HEALTH AUTHORITY › Division 45 - ABUSE INVESTIGATIONS AND SAFETY › Section 943-045-0410

Current through Register Vol. 63, No. 7, July 1, 2024
Stat. Auth.: ORS
				  179.040,
				  413.042
Stats. Implemented: ORS
				  179.390,
				  426.385,
				  427.031,
				  430.210,
				  430.735-430.768
Oregon Administrative Rules › Chapter 943 - OREGON HEALTH AUTHORITY › Division 45 - ABUSE INVESTIGATIONS AND SAFETY › Section 943-045-0420

Current through Register Vol. 63, No. 7, July 1, 2024
Stat. Auth.: ORS
				  179.040,
				  413.042
Stats. Implemented: ORS
				  179.390,
				  426.385,
				  427.031,
				  430.210,
				  430.735-430.768
Oregon Administrative Rules › Chapter 943 - OREGON HEALTH AUTHORITY › Division 45 - ABUSE INVESTIGATIONS AND SAFETY › Section 943-045-0430

Current through Register Vol. 63, No. 7, July 1, 2024
Stat. Auth.: ORS
				  179.040,
				  413.042
Stats. Implemented: ORS
				  179.390,
				  426.385,
				  427.031,
				  430.210,
				  430.735-430.768
Oregon Administrative Rules › Chapter 943 - OREGON HEALTH AUTHORITY › Division 45 - ABUSE INVESTIGATIONS AND SAFETY › Section 943-045-0440

Current through Register Vol. 63, No. 7, July 1, 2024
Stat. Auth.: ORS
				  179.040,
				  413.042
Stats. Implemented: ORS
				  179.390,
				  426.385,
				  427.031,
				  430.210,
				  430.735-430.768
Oregon Administrative Rules › Chapter 943 - OREGON HEALTH AUTHORITY › Division 45 - ABUSE INVESTIGATIONS AND SAFETY › Section 943-045-0450

Current through Register Vol. 63, No. 7, July 1, 2024
Stat. Auth.: ORS
				  179.040,
				  413.042
Stats. Implemented: ORS
				  179.390,
				  426.385,
				  427.031,
				  430.210,
				  430.735-430.768
Oregon Administrative Rules › Chapter 943 - OREGON HEALTH AUTHORITY › Division 45 - ABUSE INVESTIGATIONS AND SAFETY › Section 943-045-0460

Current through Register Vol. 63, No. 7, July 1, 2024
Stat. Auth.: ORS
				  179.040,
				  413.042
Stats. Implemented: ORS
				  179.390,
				  426.385,
				  427.031,
				  430.210,
				  430.735-430.768
Oregon Administrative Rules › Chapter 943 - OREGON HEALTH AUTHORITY › Division 45 - ABUSE INVESTIGATIONS AND SAFETY › Section 943-045-0470

Current through Register Vol. 63, No. 7, July 1, 2024
Stat. Auth.: ORS
				  179.040,
				  413.042
Stats. Implemented: ORS
				  179.390,
				  426.385,
				  427.031,
				  430.210,
				  430.735-430.768
Oregon Administrative Rules › Chapter 943 - OREGON HEALTH AUTHORITY › Division 45 - ABUSE INVESTIGATIONS AND SAFETY › Section 943-045-0480

Current through Register Vol. 63, No. 7, July 1, 2024
Stat. Auth.: ORS
				  179.040,
				  413.042
Stats. Implemented: ORS
				  179.390,
				  426.385,
				  427.031,
				  430.210,
				  430.735-430.768
Oregon Administrative Rules › Chapter 943 - OREGON HEALTH AUTHORITY › Division 45 - ABUSE INVESTIGATIONS AND SAFETY › Section 943-045-0490

Current through Register Vol. 63, No. 7, July 1, 2024
Stat. Auth.: ORS
				  179.040,
				  413.042
Stats. Implemented: ORS
				  179.390,
				  426.385,
				  427.031,
				  430.210,
				  430.735-430.768
Oregon Administrative Rules › Chapter 943 - OREGON HEALTH AUTHORITY › Division 45 - ABUSE INVESTIGATIONS AND SAFETY › Section 943-045-0500

Current through Register Vol. 63, No. 7, July 1, 2024
Stat. Auth.: ORS
				  179.040,
				  413.042
Stats. Implemented: ORS
				  179.390,
				  426.385,
				  427.031,
				  430.210,
				  430.735-430.768
Oregon Administrative Rules › Chapter 943 - OREGON HEALTH AUTHORITY › Division 45 - ABUSE INVESTIGATIONS AND SAFETY › Section 943-045-0510

Current through Register Vol. 63, No. 7, July 1, 2024
Stat. Auth.: ORS
				  179.040,
				  413.042
Stats. Implemented: ORS
				  179.390,
				  426.385,
				  427.031,
				  430.210,
				  430.735-430.768
Oregon Administrative Rules › Chapter 943 - OREGON HEALTH AUTHORITY › Division 45 - ABUSE INVESTIGATIONS AND SAFETY › Section 943-045-0520

Current through Register Vol. 63, No. 7, July 1, 2024
Statutory/Other Authority: ORS 179.040 & 413.042
Statutes/Other Implemented: ORS 179.390, 426.385, 427.031,
				  430.210 & 430.731-430.768
Oregon Administrative Rules › Chapter 943 - OREGON HEALTH AUTHORITY › Division 60 - PUBLIC CONTRACTING AND PROCUREMENT › Section 943-060-0000 - Application

Current through Register Vol. 63, No. 7, July 1, 2024
These rules (OAR 943-060-0000  to 943-060-0120)
				govern public contracting of the Oregon Health Authority and are
				subject to ORS chapters 279A, 279B, and 279C.
Stat. Auth.: ORS
				  413.042
Stats. Implemented: ORS
				  179.040,
				  279A.065,
				  413.033 &
				  413.042
Oregon Administrative Rules › Chapter 943 - OREGON HEALTH AUTHORITY › Division 60 - PUBLIC CONTRACTING AND PROCUREMENT › Section 943-060-0010 - Definitions

Current through Register Vol. 63, No. 7, July 1, 2024
Unless the context requires otherwise, the following
				definitions apply:
(1)
			 "Authority" means the Oregon Health Authority.
(2) "Client" means any individual,
			 family, or provider:
(a) For whom
			 the Authority provides services and incidental or specialized goods,
			 in any combination thereof, according to state, federal law, rule,
			 and policy. Services and incidental goods include but are not limited
			 to treatment, care, protection, and support without regard to the
			 proximity of the services being provided;
(b) Who receives and utilizes
			 services provided by the Authority primarily for that individual's or
			 family's benefit;
(c) Who
			 is under the custody, care, or both of the Authority; or
(d) Who provides direct care or
			 services and is a proxy or representative of a non-provider
			 client.