Oregon Administrative Rules › Chapter 407 - DEPARTMENT OF HUMAN SERVICES › Division 14 - PRIVACY AND CONFIDENTIALITY › Section 407-014-0030 - Client Privacy Rights

Current through Register Vol. 63, No. 7, July 1, 2024
(1)
			 Rights of clients to access their information. Clients may access, inspect, and
			 obtain a copy of information on their own cases in Department files or records,
			 consistent with federal and state law.
(a) A
			 client may request access by completing the Access to Records Request form, or
			 by providing sufficient information to accomplish this request.
(b) Clients may request access to their own
			 information that is kept by the Department by using a personal identifier such
			 as the client's name or Department case number.
(c) If the Department maintains information
			 in a record that includes information about other people, the client may see
			 information only about himself or herself.
(d) If a person identified in the file is a
			 minor child of the client, and the client is authorized under Oregon law to
			 have access to the minor's information or to act on behalf of the minor for
			 making decisions about the minor's care, the client may obtain information
			 about the minor.
(e) If the
			 requestor of information is recognized under Oregon law as a the client's
			 guardian or custodian and is authorized under Oregon law to have access to the
			 client's information or to act on behalf of the client for making decisions
			 about the client's services or care, the Department shall release information
			 to the requestor.
(f) For
			 individuals with disabilities or mental illnesses, the named system in ORS
			 192.517, to protect and advocate
			 the rights of individuals with developmental disabilities under Part C of the
			 Developmental Disabilities Assistance and Bill of Rights Act (42
			 U.S.C. 6041 et seq.) and the rights of
			 individuals with mental illness under the Protection and Advocacy for
			 Individuals with Mental Illness Act (42 U.S.C.
			 10801 et seq.), shall have access to all
			 records defined in ORS
			 192.515.
(g) The Department may deny a client's access
			 to their own PHI if federal law prohibits the disclosure. Clients may access,
			 inspect, and obtain a copy of health information on their own case in
			 Department files or records except for the following:
(A) Psychotherapy notes;
(B) Information compiled in reasonable
			 anticipation of, or for use in civil, criminal, or administrative
			 proceedings;
(C) Information that
			 is subject to the federal Clinical Labs Improvement Amendments of 1988, or
			 exempt pursuant to
			 42
			 CFR 493.3(a)(2);
(D) Information that the Department believes,
			 in good faith, can cause harm to the client, participant, or to any other
			 person; and
(E) Documents protected
			 by attorney work-product privilege.
(h) The Department may deny a client access
			 to information that was obtained under a promise of confidentiality from a
			 person other than a health care provider to the extent that access would reveal
			 the source of the information.
(i)
			 The Department may deny a client access to information, if the Department gives
			 the client a right to have the denial reviewed when:
(A) A licensed health care professional (for
			 health information) or other designated staff (for other information) has
			 determined, in the exercise of professional judgment, that the information
			 requested may endanger the life or physical safety of the client or another
			 person;
(B) The information makes
			 reference to another person, and a licensed health care professional (for
			 health information) or other designated staff (for other information) has
			 determined, in the exercise of professional judgment, that the information
			 requested may cause substantial harm to the client or to another person;
			 or
(C) The request for access is
			 made by the client's personal representative, and a licensed health care
			 professional (for health information) or other designated staff (for other
			 information) has determined, in the exercise of professional judgment, that
			 allowing the personal representative access to the information may cause
			 substantial harm to the client or to another person.
(j) If the Department denies access under
			 section (1)(i) of this rule, the client may have the decision reviewed by a
			 licensed health care professional (for health information) or other designated
			 staff (for other information) not directly involved in making the original
			 denial decision.
(A) The Department must
			 promptly refer a client's request for review to the designated
			 reviewer.
(B) The reviewer must
			 determine, within the 30 or 60-day time limits stated in section (1)(k)(A) and
			 (B) of this rule, whether to approve or deny the client's request for
			 access.
(C) Based on the reviewer's
			 decision, the Department shall:
(i) Promptly
			 notify the client in writing of the reviewer's determination; and
(ii) If approved, take action to carry out
			 the reviewer's determination.
(k) The Department must act on a client's
			 request for access no later than 30 days after receiving the request, except as
			 provided in this section and in the case of written accounts under ORS
			 179.505, which must be disclosed
			 within five days.
(A) In cases where the
			 information is not maintained or accessible to the Department on-site, and does
			 not fall under ORS 179.505, the Department must act
			 on the client's request no later than 60 days after receiving the
			 request.
(B) If the Department is
			 unable to act within the 30 or 60-day limits, the Department may extend this
			 time period a maximum of 30 additional days, subject to the following:
(i) The Department must notify the client in
			 writing of the reasons for the delay and the date by which the Department shall
			 act on the request.
(ii) The
			 Department shall use only one 30-day extension.
(l) If the Department grants the client's
			 request, in whole or in part, the Department must inform the client of the
			 access decision and provide the requested access.
(A) If the Department maintains the same
			 information in more than one format or at more than one location, the
			 Department may provide the requested information once.
(B) The Department must provide the requested
			 information in a form or format requested by the client, if readily producible
			 in that form or format. If not readily producible, the Department shall provide
			 the information in a readable hard-copy format or other format as agreed to by
			 the Department and the client.
(C)
			 The Department may provide the client with a summary of the requested
			 information, in lieu of providing access, or may provide an explanation of the
			 information if access has been provided, if:
(i) The client agrees in advance;
			 and
(ii) The client agrees in
			 advance to pay any fees the Department may impose, under section (1)(L)(E) of
			 this rule.
(D) The
			 Department shall arrange with the client for providing the requested access in
			 a time, place, and manner convenient for the client and the Department.
(E) If a client, or legal guardian
			 or custodian, requests a copy, written summary, or explanation of the requested
			 information, the Department may impose a reasonable cost-based fee, limited to
			 the following:
(i) Copying the requested
			 information, including the costs of supplies and the labor of
			 copying;
(ii) Postage;
			 and
(iii) Staff time for preparing
			 an explanation or summary of the requested
			 information.
(m) If the Department denies access, in whole
			 or in part, to the requested information, the Department must:
(A) Give the client access to any other
			 requested client information, after excluding the information to which access
			 is denied; and
(B) Provide the
			 client with a timely written denial. The denial must:
(i) Be provided within the time limits
			 specified in section (1)(k)(A) and (B) of this rule;
(ii) State the basis of the denial in plain
			 language;
(iii) If the Department
			 denies access under section (1)(i) of this rule, explain the client's review
			 rights as specified in section (1)(j) of this rule, including an explanation of
			 how the client may exercise these rights; and
(iv) Provide a description of how the client
			 may file a complaint with the Department, and if the information is PHI, with
			 the United States Department of Health and Human Services (DHHS), Office for
			 Civil Rights, pursuant to section (7) of this rule.
(n) If the Department does not
			 maintain the requested information, in whole or in part, and knows where the
			 information is maintained (such as by a medical provider, insurer, other public
			 agency, private business, or other non-Department entity), the Department must
			 inform the client where to direct the request for access.