Oregon Administrative Rules › Chapter 943 - OREGON HEALTH AUTHORITY › Division 14 - PRIVACY AND CONFIDENTIALITY › Section 943-014-0030 - Client Privacy Rights

Current through Register Vol. 63, No. 7, July 1, 2024
(1) Rights of clients to access
			 their information. Clients may access, inspect, and obtain a copy of
			 information on their own cases in Authority files or records,
			 consistent with federal and state law.
(a) A client may request access by
			 completing the Access to Records Request form, or by providing
			 sufficient information to accomplish this request.
(b) Clients may request access to
			 their own information that is kept by the Authority by using a
			 personal identifier such as the client's name or Authority case
			 number.
(c) If the
			 Authority maintains information in a record that includes information
			 about other people, the client may see information only about himself
			 or herself.
(d) If a
			 person identified in the file is a minor child of the client, and the
			 client is authorized under Oregon law to have access to the minor's
			 information or to act on behalf of the minor for making decisions
			 about the minor's care, the client may obtain information about the
			 minor.
(e) If the
			 requestor of information is recognized under Oregon law as a the
			 client's guardian or custodian and is authorized under Oregon law to
			 have access to the client's information or to act on behalf of the
			 client for making decisions about the client's services or care, the
			 Authority shall release information to the requestor.
(f) For individuals with
			 disabilities or mental illnesses, the named system in ORS
			 192.517, to protect
			 and advocate the rights of individuals with developmental
			 disabilities under Part C of the Developmental Disabilities
			 Assistance and Bill of Rights Act (42 U.S.C. 6041
			 et seq.) and the rights of individuals with mental illness under the
			 Protection and Advocacy for Individuals with Mental Illness Act (42 U.S.C.
			 10801 et seq.), shall have access
			 to all records defined in ORS
			 192.515.
(g) The Authority may deny a
			 client's access to their own PHI if federal law prohibits the
			 disclosure. Clients may access, inspect, and obtain a copy of health
			 information on their own case in Authority files or records except
			 for the following:
(A) Psychotherapy
			 notes;
(B) Information
			 compiled in reasonable anticipation of, or for use in civil,
			 criminal, or administrative proceedings;
(C) Information that is subject to
			 the federal Clinical Labs Improvement Amendments of 1988, or exempt
			 pursuant to
			 42 CFR
			 493.3(a)(2);
(D) Information that the Authority
			 believes, in good faith, can cause harm to the client, participant,
			 or to any other person; and
(E) Documents protected by attorney
			 work-product privilege.
(h) The Authority may deny a client
			 access to information that was obtained under a promise of
			 confidentiality from a person other than a health care provider to
			 the extent that access would reveal the source of the
			 information.
(i) The
			 Authority may deny a client access to information, if the Authority
			 gives the client a right to have the denial reviewed when:
(A) A licensed health care
			 professional (for health information) or other designated staff (for
			 other information) has determined, in the exercise of professional
			 judgment, that the information requested may endanger the life or
			 physical safety of the client or another person;
(B) The information makes reference
			 to another person, and a licensed health care professional (for
			 health information) or other designated staff (for other information)
			 has determined, in the exercise of professional judgment, that the
			 information requested may cause substantial harm to the client or to
			 another person; or
(C)
			 The request for access is made by the client's personal
			 representative, and a licensed health care professional (for health
			 information) or other designated staff (for other information) has
			 determined, in the exercise of professional judgment, that allowing
			 the personal representative access to the information may cause
			 substantial harm to the client or to another person.
(j) If the Authority
			 denies access under section (1)(i) of this rule, the client may have
			 the decision reviewed by a licensed health care professional (for
			 health information) or other designated staff (for other information)
			 not directly involved in making the original denial decision.
(A) The Authority must promptly
			 refer a client's request for review to the designated
			 reviewer.
(B) The
			 reviewer must determine, within the 30 or 60-day time limits stated
			 in section (1)(k)(A) and (B) of this rule, whether to approve or deny
			 the client's request for access.
(C) Based on the reviewer's
			 decision, the Authority shall:
(i)
			 Promptly notify the client in writing of the reviewer's
			 determination; and
(ii)
			 If approved, take action to carry out the reviewer's
			 determination.
(k) The Authority must act on a
			 client's request for access no later than 30 days after receiving the
			 request, except as provided in this section and in the case of
			 written accounts under ORS
			 179.505, which must be
			 disclosed within five days.
(A) In
			 cases where the information is not maintained or accessible to the
			 Authority on-site, and does not fall under ORS
			 179.505, the Authority
			 must act on the client's request no later than 60 days after
			 receiving the request.
(B) If the Authority is unable to
			 act within the 30 or 60-day limits, the Authority may extend this
			 time period a maximum of 30 additional days, subject to the
			 following:
(i) The Authority must
			 notify the client in writing of the reasons for the delay and the
			 date by which the Authority shall act on the request.
(ii) The Authority shall use only
			 one 30-day extension.
(l) If the Authority grants the
			 client's request, in whole or in part, the Authority must inform the
			 client of the access decision and provide the requested access.
(A) If the Authority maintains the
			 same information in more than one format or at more than one
			 location, the Authority may provide the requested information
			 once.
(B) The Authority
			 must provide the requested information in a form or format requested
			 by the client, if readily producible in that form or format. If not
			 readily producible, the Authority shall provide the information in a
			 readable hard-copy format or other format as agreed to by the
			 Authority and the client.
(C) The Authority may provide the
			 client with a summary of the requested information, in lieu of
			 providing access, or may provide an explanation of the information if
			 access has been provided, if:
(i)
			 The client agrees in advance; and
(ii) The client agrees in advance
			 to pay any fees the Authority may impose, under section (1)(L)(E) of
			 this rule.
(D)
			 The Authority shall arrange with the client for providing the
			 requested access in a time, place, and manner convenient for the
			 client and the Authority.
(E) If a client, or legal guardian
			 or custodian, requests a copy, written summary, or explanation of the
			 requested information, the Authority may impose a reasonable
			 cost-based fee, limited to the following:
(i) Copying the requested
			 information, including the costs of supplies and the labor of
			 copying;
(ii) Postage;
			 and
(iii) Staff time for
			 preparing an explanation or summary of the requested
			 information.
(m) If the Authority denies access,
			 in whole or in part, to the requested information, the Authority
			 must:
(A) Give the client access to
			 any other requested client information, after excluding the
			 information to which access is denied; and
(B) Provide the client with a
			 timely written denial. The denial must:
(i) Be provided within the time
			 limits specified in section (1)(k)(A) and (B) of this rule;
(ii) State the basis of the denial
			 in plain language;
(iii)
			 If the Authority denies access under section (1)(i) of this rule,
			 explain the client's review rights as specified in section (1)(j) of
			 this rule, including an explanation of how the client may exercise
			 these rights; and
(iv)
			 Provide a description of how the client may file a complaint with the
			 Authority, and if the information is PHI, with the United States
			 Department of Health and Human Services (DHHS), Office for Civil
			 Rights, pursuant to section (7) of this rule.
(n) If the Authority
			 does not maintain the requested information, in whole or in part, and
			 knows where the information is maintained (such as by a medical
			 provider, insurer, other public agency, private business, or other
			 non-Authority entity), the Authority must inform the client where to
			 direct the request for access.