Oregon Administrative Rules › Chapter 409 - OREGON HEALTH AUTHORITY, HEALTH POLICY AND ANALYTICS › Division 25 - ALL PAYER ALL CLAIMS DATA REPORTING PROGRAM › Section 409-025-0160 - Data Access and Release

Current through Register Vol. 63, No. 7, July 1, 2024
(1) The
			 Authority shall comply with all relevant state and federal data privacy,
			 security, and antitrust regulations, including The Health Insurance Portability
			 and Accountability Act (HIPAA), when sharing APAC data.
(2) The Authority may collect payment to
			 recoup costs when APAC data requests are fulfilled.
(3) The Authority shall provide a public use
			 data set, which shall include de-identified member health information, in
			 compliance with applicable Authority policies and state and federal rules,
			 regulations, and statutes.
(a) The Authority
			 shall maintain a list of data elements included in APAC public use data
			 sets.
(b) Requestors seeking access
			 to an APAC public use data set shall complete a Public Use Data File
			 Application (APAC-2). Payment is required as follows:
(A) Actual cost with a maximum cost of $500
			 per data year for Medical Claims;
(B) Actual cost with a maximum cost of $500
			 per data year for Pharmacy Claims;
(C) Actual cost with a maximum cost of $500
			 per data year for Dental Claims; and
(D) Enrollment file requested in conjunction
			 with Medical, Pharmacy or Dental Claims will be provided without additional
			 charge.
(c) The
			 Authority may approve or deny the completed request and provide written
			 notification to the requestor within 30 calendar days of receipt of the
			 request.
(d) The Authority shall
			 deny the completed request for reasons which include, but are not limited to:
(A) Requestor or any person who will have
			 access to the data has previously violated a data use agreement with the
			 Authority.
(B) The Authority finds
			 that the specific details of the request do not sufficiently explain the
			 proposed use.
(C) The Authority
			 finds that the specific details of the request violate any state or federal
			 rule, regulation, or statute.
(D)
			 Full payment is not included with the application or received within thirty
			 (30) days of invoicing.
(e) If the Authority denies the Public Use
			 Application (APAC-2):
(A) The Authority shall
			 provide written notification stating the reason for the denial and process
			 return of payment; and
(B) The
			 requestor may appeal the denial by requesting a contested case hearing. The
			 appeal must be filed within 30 business days of the denial. The appeal process
			 is conducted pursuant to ORS chapter 183 and the Attorney General's Uniform and
			 Model Rules of Procedure, OAR 137-003-0501  to 137-003-0700. The requestor shall
			 have the burden to prove that the Authority unreasonably denied the
			 application.
(f) The
			 public use data sets may not be used to identify any individual, including
			 members or subscribers. The requestor may not use outside information to
			 attempt to ascertain the identity of individuals who are the subject of public
			 use data sets.
(g) Provider
			 information will be reviewed for information that may be considered personally
			 identifiable information.
(A) If a taxpayer
			 identification number is determined to be a social security number, such
			 information shall not be released.
(B) Information already available to the
			 public including published licensing data or public-facing data from the
			 National Plan & Provider Enumeration System shall not be considered
			 personally identifiable information.