reglab/statecodes huggingface dataset:
Oregon Administrative Rules › Chapter 407 - DEPARTMENT OF HUMAN SERVICES › Division 12 - RESTRICTING ACCESS TO DEPARTMENT OF HUMAN SERVICES PREMISES AND EMPLOYEES › Section 407-012-0005 - Definitions

Current through Register Vol. 63, No. 7, July 1, 2024
The following definitions apply to OAR 407-012-0005  through
				407-012-0025:
(1) "Department" means
			 the Department of Human Services.
(2) "Division" means every individual
			 organizational unit within the Department of Human Services.
(3) "Employee" means individuals acting in
			 the course and scope of their duties who are on the State of Oregon payroll,
			 contract employees, employees of temporary service agencies, and volunteers. It
			 also includes employees of other government or social service agencies who, at
			 the time they are accompanying a Department employee on Department business,
			 are the target of conduct described in OAR 407-012-0010.
(4) "Premises" means any land, building,
			 facility, and other property owned, leased, or in the possession of, and used
			 or controlled by the Department. When the Department occupies space in a
			 building occupied by multiple tenants, the definition includes the common areas
			 of the building used by all tenants such as, but not limited to, restrooms,
			 hallways, and food service areas.
(5) "Restriction of Access" means the
			 Department has limited an individual's access to specific Department premises,
			 employees, or methods of communication.
(6) "Weapon" includes, but is not limited to:
(a) A dangerous or deadly weapon as defined
			 in ORS 161.015;
(b) Any other object or substance used in a
			 manner that compromises the safety of Department employees or visitors on
			 Department premises;
(c) An
			 imitation or replica of any of the above.
Oregon Administrative Rules › Chapter 407 - DEPARTMENT OF HUMAN SERVICES › Division 12 - RESTRICTING ACCESS TO DEPARTMENT OF HUMAN SERVICES PREMISES AND EMPLOYEES › Section 407-012-0010 - Prohibited Conduct

Current through Register Vol. 63, No. 7, July 1, 2024
(1) Conduct that
			 may result in restriction of access includes, but is not limited to the
			 following:
(a) Causing or threatening to
			 cause physical injury to Department employees or visitors;
(b) Engaging in actions which compromise the
			 safety or health of Department employees or visitors;
(c) Causing or threatening to cause harm to
			 the family or property of an employee or visitors through written, electronic,
			 or verbal communication;
(d)
			 Causing or threatening to cause damage to Department premises;
(e) Bringing a deadly or dangerous weapon
			 onto the Department's premises, unless authorized by ORS chapter 166 to carry a
			 handgun;
(f) Displaying,
			 attempting, or threatening to use any weapon, on or off Department premises,
			 that compromises the safety of Department employees or visitors;
(g) Engaging in harassing conduct as defined
			 in ORS 166.065.
(h) Engaging in telephonic harassment as
			 defined in ORS 166.090.
Oregon Administrative Rules › Chapter 407 - DEPARTMENT OF HUMAN SERVICES › Division 12 - RESTRICTING ACCESS TO DEPARTMENT OF HUMAN SERVICES PREMISES AND EMPLOYEES › Section 407-012-0015 - Continuation of Eligible Services

Current through Register Vol. 63, No. 7, July 1, 2024
(1)
			 An individual whose access has been restricted by the Department will continue
			 to be provided services for which the individual meets program eligibility
			 requirements by an alternate and effective method of communication as
			 determined by the Department.
(2)
			 Alternate methods may include telephone, electronic mail, written
			 communication, meeting at a designated secure site, or through the individual's
			 representative.
Stat. Auth.: ORS
				  409.050
Stats. Implemented: ORS
				  409.050,
				  654.010
Oregon Administrative Rules › Chapter 407 - DEPARTMENT OF HUMAN SERVICES › Division 12 - RESTRICTING ACCESS TO DEPARTMENT OF HUMAN SERVICES PREMISES AND EMPLOYEES › Section 407-012-0020 - Notification

Current through Register Vol. 63, No. 7, July 1, 2024
(1) If the
			 Department determines that it is necessary to restrict access or the methods of
			 communication because of prohibited conduct, the individual will be provided
			 written notification, signed by the assistant director or deputy assistant
			 director of the affected division, and sent by certified mail or other
			 traceable means. The notice will describe the following:
(a) Conduct giving rise to the
			 restrictions;
(b) The specific
			 premises or parts of premises from which the individual is excluded; or the
			 forms of communication which are restricted;
(c) The alternate method by which services
			 may be obtained;
(d) Contact
			 information for services or appointment scheduling;
(e) The availability of the review process,
			 including notification that individuals with disabilities are entitled to
			 request modification;
(f) The
			 potential criminal consequences for violating the notice of restriction of
			 access; and
(g) The law enforcement
			 agency being notified.
Oregon Administrative Rules › Chapter 407 - DEPARTMENT OF HUMAN SERVICES › Division 12 - RESTRICTING ACCESS TO DEPARTMENT OF HUMAN SERVICES PREMISES AND EMPLOYEES › Section 407-012-0025 - Department Review

Current through Register Vol. 63, No. 7, July 1, 2024
(1) The
			 Department will establish an internal review process to ensure that a notice of
			 restriction of access is warranted prior to issuing a written notice of
			 restriction of access.
(2)
			 Following the Department's issuance of a notice of restriction of access, the
			 recipient of the notice may request review of the Department's determination.
			 The request must be submitted to the office of the Director of the Department.
			 The request must be in writing and submitted, by mail or personal delivery,
			 within 15 business days of the date of issuance of the notice of restriction of
			 access. If the request is submitted by mail, it must be postmarked within 15
			 business days. No particular format is required for the request for review;
			 however, the individual should include specific grounds for requesting the
			 review.
(3) Upon receipt of a
			 request for review, the Director or an assistant director will review the
			 request and issue a written decision. The review may include an informal
			 conference. The decision will be issued within ten days of receipt of the
			 request for review.
(4) The
			 Department's decision is final.
(5)
			 If the Department's decision rules in favor of the individual, the restricted
			 individual's access restriction will be immediately lifted. If the decision is
			 unfavorable to the restricted individual, the restricted individual may seek
			 further review after six months have lapsed since the date of issuance by
			 following the process described in this rule.
Stat. Auth.: ORS
				  409.050
Stats. Implemented: ORS
				  409.050,
				  654.010
Oregon Administrative Rules › Chapter 407 - DEPARTMENT OF HUMAN SERVICES › Division 14 - PRIVACY AND CONFIDENTIALITY › Section 407-014-0000 - Definitions

Current through Register Vol. 63, No. 7, July 1, 2024
The following definitions apply to OAR 407-014-0000  to
				407-014-0070:
(1) "Administrative
			 hearing" means an oral proceeding before an administrative law judge in a
			 contested case hearing.
(2)
			 "Authority" means the Oregon Health Authority.
(3) "Authorization" means permission from an
			 individual or his or her personal representative giving the Department of Human
			 Services (Department) authorization to obtain, release or use information about
			 the individual from third parties for specified purposes or to disclose
			 information to a third party specified by the individual.
(4) "Business associate" means an individual
			 or entity performing any function or activity on behalf of the Authority,
			 including the Department, involving the use or disclosure of protected health
			 information (PHI) and is not a member of the Authority's workforce.
(a) For purposes of the definition of
			 "business associate," "function or activity" includes but is not limited to
			 program administration, claims processing or administration, data analysis,
			 utilization review, quality assurance, billing, legal, actuarial, accounting,
			 consulting, data processing, management, administrative, accreditation,
			 financial services, and similar services for which the Authority may contract
			 or obtain by interagency agreement, if access to PHI is involved.
(b) Business associates do not include
			 licensees or providers unless the licensee or provider also performs some
			 function or activity on behalf of the Authority.
Oregon Administrative Rules › Chapter 407 - DEPARTMENT OF HUMAN SERVICES › Division 14 - PRIVACY AND CONFIDENTIALITY › Section 407-014-0010 - Purpose

Current through Register Vol. 63, No. 7, July 1, 2024
(1) The purpose of
			 these rules (OAR 407-014-000 to 407-014-0070) is to govern the collection, use,
			 and disclosure of protected information by the Department about individuals and
			 to explain the rights and specific actions that individuals may take or request
			 to be taken regarding the uses and disclosures of their protected information.
			 These rules also set forth Department requirements governing the use and
			 disclosure of PHI for purposes of HIPAA,
			 42 USC
			 1320 -d through 1320d-8, Pub L 104-191, sec.
			 262 and 264, and the implementing HIPAA privacy rules, 45 CFR parts 160 and
			 164.
(2) Except as provided in
			 section (1) of this rule, state and federal statutes, rules, and policies that
			 govern the administration of Department programs, services, and activities
			 continue to govern the use and disclosure of protected information in those
			 Department programs, services, and activities.
(3) In the event that it is not possible to
			 comply with the requirements of both sections (1) and (2) of this rule, the
			 Department shall act in accordance with whichever federal or state law imposes
			 a stricter requirement regarding the privacy or safeguarding of information and
			 which provides the greater protection or access to the individual who is the
			 subject of the information, unless one of the following applies:
(a) Public health. Nothing in these rules
			 shall be construed to invalidate or limit the authority, power, or procedures
			 established under any law providing for the reporting of disease or injury,
			 birth, or death; public health surveillance; or public health investigation or
			 intervention.
(b) Child abuse.
			 Nothing in these rules shall be construed to invalidate or limit the authority,
			 power, or procedures established under any law providing for the reporting of
			 child abuse.
(c) State regulatory
			 reporting. Nothing in these rules shall be construed to limit the ability of
			 the State of Oregon or the Department to require a health plan to report, or to
			 provide access to information for management audits, financial audits, program
			 monitoring, facility licensure or certification, or individual licensure or
			 certification.
Oregon Administrative Rules › Chapter 407 - DEPARTMENT OF HUMAN SERVICES › Division 14 - PRIVACY AND CONFIDENTIALITY › Section 407-014-0015 - Information Governed by the HIPAA Privacy Rules

Current through Register Vol. 63, No. 7, July 1, 2024
(1) These rules address information that,
			 among other things, may be PHI that is protected by the HIPAA Privacy Rules.
			 For purposes of HIPAA Privacy Rules, the Authority is a covered entity,
			 primarily because of its role as the state Medicaid and Children's Health
			 Insurance Program.
(2) The
			 Authority administers many aspects of the medical assistance program with the
			 assistance of the Department, including but not limited to eligibility
			 determinations for the medical assistance program and supervising the long-term
			 and community-based services for seniors and people with disabilities. The
			 Department also provides certain health care operations services for the
			 Authority. In doing so, the Department is a business associate of the
			 Authority. As a business associate of the Authority, the Department is
			 authorized to use and disclose protected health information to perform or
			 assist the Authority in the performance of its covered functions, in a manner
			 consistent with these rules.
(3)
			 These rules only apply to information maintained by the Department as a
			 business associate of the Authority.
Stat. Auth.: ORS
				  409.050
Stats. Implemented: ORS
				  409.010
Oregon Administrative Rules › Chapter 407 - DEPARTMENT OF HUMAN SERVICES › Division 14 - PRIVACY AND CONFIDENTIALITY › Section 407-014-0020 - Uses and Disclosures of Client or Participant Protected Information

Current through Register Vol. 63, No. 7, July 1, 2024
(1) Uses and
			 disclosures with individual authorization. The Department must obtain a
			 completed and signed authorization for release of information from the
			 individual, or the individual's personal representative, before obtaining or
			 using protected information about an individual from a third party or
			 disclosing protected information about the individual to a third party.
(a) Uses and disclosures must be consistent
			 with what the individual has approved on the signed authorization form approved
			 by the Department.
(b) An
			 individual may revoke an authorization at any time. The revocation must be in
			 writing and signed by the individual, except that substance abuse treatment
			 patients may orally revoke an authorization to disclose information obtained
			 from substance abuse treatment programs. No revocation shall apply to
			 information already released while the authorization was valid and in
			 effect.
Oregon Administrative Rules › Chapter 407 - DEPARTMENT OF HUMAN SERVICES › Division 14 - PRIVACY AND CONFIDENTIALITY › Section 407-014-0040 - Minimum Necessary Standards

Current through Register Vol. 63, No. 7, July 1, 2024
(1)
			 The Department shall limit the use and disclosure of protected information to
			 that which is reasonably necessary to accomplish the intended purpose of the
			 use or disclosure which is referred to in these rules as the minimum necessary
			 standard.
(2) This minimum
			 necessary standard is not intended to impede essential Department
			 activities.
(3) The minimum
			 necessary standard applies:
(a) When using
			 protected information within the Department;
(b) When disclosing protected information to
			 a third party in response to a request; or
(c) When requesting protected information
			 from another covered entity.
Oregon Administrative Rules › Chapter 407 - DEPARTMENT OF HUMAN SERVICES › Division 14 - PRIVACY AND CONFIDENTIALITY › Section 407-014-0050 - Business Associate

Current through Register Vol. 63, No. 7, July 1, 2024
(1) The
			 Department is a business associate of the Authority. The Authority is the
			 single state Medicaid agency, but the Department performs or assists in the
			 performance of key components of the medical assistance program under the
			 supervision of the Authority including but not limited to eligibility
			 determinations for the medical assistance program and supervising the long-term
			 and community-based services for seniors and people with disabilities. The
			 Department also provides certain health care operations services for the
			 Authority. In doing so, the Department is a business associate of the
			 Authority. As a business associate of the Authority, the Department is
			 authorized to use and disclose protected health information to perform or
			 assist the Authority in the performance of its covered functions. However, as a
			 business associate, the Department is subject to the privacy requirements
			 described in these rules.
(2) As a
			 business associate of the Authority implementing the requirements of the
			 medical assistance program, the Department may disclose an individual's PHI to
			 its contractors or providers, and may allow its contractors or providers to
			 create or receive an individual's PHI on behalf of the Department if the
			 contract or agreement that complies with applicable federal and state law. In
			 some limited circumstances, the Department may determine that the Department is
			 a business associate of a covered entity. A business associate relationship
			 with the Department requires additional contractual disclosure and privacy
			 provisions that must be incorporated into the contract pursuant to 45 CFR part
			 164-504(e)(1).
(3) A contract with
			 a business associate must comply with OAR 125-055-0100  to 125-055-0130  and the
			 qualified service organization requirements in 42 CFR part 2.11.
Stat. Auth.: ORS
				  409.050
Stats. Implemented:
				  409.010
Oregon Administrative Rules › Chapter 407 - DEPARTMENT OF HUMAN SERVICES › Division 14 - PRIVACY AND CONFIDENTIALITY › Section 407-014-0060 - Uses and Disclosures of Protected Information for Research Purposes

Current through Register Vol. 63, No. 7, July 1, 2024
The Department may use and disclose an individual's information
				for research purposes as specified in this rule.
(1) All research disclosures are subject to
			 applicable requirements of federal and state laws and rules including but not
			 limited to  45 CFR part 46  and  21 CFR part 50.0 to 50.56, relating to the
			 protection of human research subjects.
(2) The Department may use and disclose
			 de-identified information or a limited data set for research purposes, pursuant
			 to OAR 407-014-0070.
(3) The
			 Department may use and disclose information regarding an individual for
			 research purposes with the specific written authorization of the individual.
			 The authorization must meet all requirements in OAR 407-014-0030, and may
			 indicate an expiration date with terms such as "end of research study" or
			 similar language. An authorization for use and disclosure for a research study
			 may be combined with other types of written authorization for the same research
			 study. If research includes treatment, the researcher may require an
			 authorization for use and disclosure for the research as a provision of
			 providing research related treatment.
(4) Notwithstanding section (3) of this rule,
			 the Department may use and disclose an individual's information for research
			 purposes without the individual's written authorization, regardless of the
			 source of funding for the research, provided that:
(a) The Department obtains documentation that
			 a waiver of an individual's authorization for release of information
			 requirements has been approved by an IRB registered with the Office for Human
			 Research Protection. Documentation required of an IRB when granting approval of
			 a waiver of an individual's authorization for release of information must
			 include all criteria specified in  45 CFR part 164.512(i)(2).
(b) A researcher may request access to
			 individual information maintained by the Department in preparation for research
			 or to facilitate the development of a research protocol in anticipation of
			 research. The Department may determine whether to permit such use or
			 disclosure, without individual authorization or use of an IRB, pursuant to  45
			 CFR part 164.512(i)(1)(ii).
(c) A
			 researcher may request access to individual information maintained by the
			 Department about deceased individuals. The Department may determine whether to
			 permit such use or disclosure of information about decedents, without
			 individual authorization or use of an IRB, pursuant to 45 CFR part
			 164.512(i)(1)(iii).
Oregon Administrative Rules › Chapter 407 - DEPARTMENT OF HUMAN SERVICES › Division 14 - PRIVACY AND CONFIDENTIALITY › Section 407-014-0070 - De-identification of Client Information and Use of Limited Data Sets under Data Use Agreements

Current through Register Vol. 63, No. 7, July 1, 2024
(1) The
			 Department may use and disclose information as appropriate for the work of the
			 Department, without further restriction, if the Department or another entity
			 has taken steps to de-identify the information pursuant to 45 CFR part
			 164.514(a) and (b).
(2) The
			 Department may assign a code or other means of record identification to allow
			 the Department to re-identify the de-identified information provided that:
(a) The code or other means of record
			 identification is not derived from or related to information about the
			 individual and cannot otherwise be translated to identify the individual;
			 and,
(b) The Department does not
			 use or disclose the code or other means of record identification for any other
			 purpose, and does not disclose the mechanism for re-identification.
Oregon Administrative Rules › Chapter 407 - DEPARTMENT OF HUMAN SERVICES › Division 14 - PRIVACY AND CONFIDENTIALITY › Section 407-014-0200 - Confidentiality and Inadmissibility of Mediation Communications

Current through Register Vol. 63, No. 7, July 1, 2024
Pursuant to ORS
				36.224, the Department of Human
				Services adopts by reference OAR 137-005-0052  as promulgated by the Attorney
				General effective as of 11-13-2018.
Forms referenced are available from the
				  agency.
Statutory/Other Authority: ORS
				  36.224,
				  184.340 & 409.050
Statutes/Other Implemented: ORS
				  36.224, ORS
				  36.228,
				  36.230 &
				  36.232
Oregon Administrative Rules › Chapter 407 - DEPARTMENT OF HUMAN SERVICES › Division 14 - PRIVACY AND CONFIDENTIALITY › Section 407-014-0205 - Confidentiality and Inadmissibility of Workplace Interpersonal Dispute Mediation Communications

Current through Register Vol. 63, No. 7, July 1, 2024
Pursuant to ORS
				36.224,
				the Department of Human Services adopts by reference OAR 137-005-0054  as
				promulgated by the Attorney General effective as of November 13, 2018.
Statutory/Other Authority: ORS
				  36.224,
				  409.050 & OL 2015, Ch.
				  114 (SB 189)
Statutes/Other Implemented: ORS
				  36.230  & OL 2015, Ch. 114 (SB 189)
Oregon Administrative Rules › Chapter 407 - DEPARTMENT OF HUMAN SERVICES › Division 14 - PRIVACY AND CONFIDENTIALITY › Section 407-014-0300 - Scope

Current through Register Vol. 63, No. 7, July 1, 2024
These rules (OAR 407-014-0300  to 407-014-0320) apply to an
				organization or individual seeking or receiving access to Department
				information assets or network and information systems for the purpose of
				carrying out a business transaction between the Department and the user.
(1) These rules are intended to complement,
			 and not supersede, access control or security requirements in the Department's
			 Electronic Data Transmission rules, OAR 407-120-0100  to 407-120-0200, and
			 whichever rule is more specific shall control.
(2) The confidentiality of specific
			 information and the conditions for use and disclosure of specific information
			 are governed by other laws and rules, including but not limited to the
			 Department's rules for the privacy of protected information, OAR 407-014-0000  to 407-014-0070.
Stat. Auth.: ORS
				  409.050
Stats. Implemented: ORS
				  182.122
Oregon Administrative Rules › Chapter 407 - DEPARTMENT OF HUMAN SERVICES › Division 14 - PRIVACY AND CONFIDENTIALITY › Section 407-014-0305 - Definitions

Current through Register Vol. 63, No. 7, July 1, 2024
For purpose of these rules, the following terms have
				definitions set forth below. All other terms not defined in this section shall
				have the meaning used in the Health Insurance Portability and Accountability
				Act (HIPAA) security rules found at 45 CFR ¦ 164.304:
(1) "Access" means the ability or the means
			 necessary to read, communicate, or otherwise use any Department information
			 asset.
(2) "Access control process"
			 means Department forms and processes used to authorize a user, identify their
			 job assignment, and determine the required access.
(3) "Client records" means any client,
			 applicant, or participant information regardless of the media or source,
			 provided by the Department to the user, or exchanged between the Department and
			 the user.
(4) "Department" means
			 the Department of Human Services.
(5) "Incident" means the attempted or
			 successful unauthorized access, use, disclosure, modification, or destruction
			 of any network and information system or Department information asset including
			 but not limited to unauthorized disclosure of information, failure to protect
			 user's identification (ID) provided by the Department, or theft of computer
			 equipment that uses or stores any Department information asset.
(6) "Information asset" means any
			 information, also known as data, provided through the Department, regardless of
			 the source or media, which requires measures for security and privacy of the
			 information.
(7) "Network and
			 information system" means the State of Oregon's computer infrastructure which
			 provides personal communications, client records and other sensitive
			 information assets, regional, wide area and local area networks, and the
			 internetworking of various types of networks on behalf of the
			 Department.
(8) "Organization"
			 means any entity authorized by the Department to access a network and
			 information system or information asset.
(9) "User" means any individual authorized by
			 the Department to access a network and information system or information
			 asset.
Stat. Auth.: ORS
				  409.050
Stats. Implemented: ORS
				  182.122
Oregon Administrative Rules › Chapter 407 - DEPARTMENT OF HUMAN SERVICES › Division 14 - PRIVACY AND CONFIDENTIALITY › Section 407-014-0310 - Information Access

Current through Register Vol. 63, No. 7, July 1, 2024
The organization or user shall utilize the Department access
				control process for all requested and approved access. The Department shall
				notify the user of each approval or denial. When approved, the Department shall
				provide the user with a unique login identifier to access the network and
				information system or information asset. The Department may authorize the use
				of a generic login identifier..
Stat. Auth.: ORS
				  409.050
Stats. Implemented: ORS
				  182.122
Oregon Administrative Rules › Chapter 407 - DEPARTMENT OF HUMAN SERVICES › Division 14 - PRIVACY AND CONFIDENTIALITY › Section 407-014-0315 - Security Information Assets

Current through Register Vol. 63, No. 7, July 1, 2024
(1)
			 No organization or user shall access an information asset for any purpose other
			 than that specifically authorized by the Department access control
			 process.
(2) Except as specified or
			 approved by the Department, no organization or user shall alter, delete, or
			 destroy any information asset.
(3)
			 The organization shall prohibit unauthorized access by their staff,
			 contractors, agents, or others to the network and information systems or
			 Department information assets, and shall implement safeguards to prevent
			 unauthorized access in accordance with section (4) of this rule.
(4) The organization shall develop a security
			 risk management plan. The organization shall ensure that the plan includes but
			 is not limited to the following:
(a)
			 Administrative, technical, and physical safeguards commonly found in the
			 International Standards Organization 27002: 2005 security standard or National
			 Institute of Standards and Technology (NIST) 800 Series.
(b) Standards established in accordance with
			 HIPAA security rules, 45 CFR Parts 160 and 164, applicable to an organization
			 or user regarding the security and privacy of a client record, any information
			 asset, or network and information system.
(c) The organization's privacy and security
			 policies.
(d) Controls and
			 safeguards that address the security of equipment and storage of any
			 information asset accessed to prevent inadvertent destruction, disclosure, or
			 loss.
(e) Controls and safeguards
			 that ensure the security of an information asset, regardless of the media, as
			 identified below:
(A) The user keeps
			 Department-assigned access control requirements such as identification of
			 authorized users and access control information (passwords and personal
			 identification numbers (PINs)), in a secure location until access is
			 terminated;
(B) Upon request of the
			 Department, the organization makes available all information about the user's
			 use or application of the access controlled network and information system or
			 information asset; and
(C) The
			 organization or user ensures the proper handling, storage, and disposal of any
			 information asset obtained or reproduced and, when the authorized use of that
			 information ends, is consistent with any applicable record retention
			 requirements.
(f)
			 Existing security plans developed to address other regulatory requirements,
			 such as Sarbanes-Oxley Act of 2002 (PL
			 107-204), Title V of Gramm Leach Bliley Act of
			 1999, and Statement on Auditing Standards (SAS) number 70, will be deemed
			 acceptable as long as they address the above requirements.
Oregon Administrative Rules › Chapter 407 - DEPARTMENT OF HUMAN SERVICES › Division 14 - PRIVACY AND CONFIDENTIALITY › Section 407-014-0320 - User Responsibility

Current through Register Vol. 63, No. 7, July 1, 2024
The organization or user shall not make any root level changes
				to any Department or State of Oregon network and information system. The
				Department recognizes that some application users have root level access to
				certain functions to allow the user to diagnose problems (such as startup or
				shutdown operations, disk layouts, user additions, deletions or modifications,
				or other operation) that require root privileges. This access does not give the
				user the right to make any changes normally restricted to root without
				explicit, written permission from the Department.
(1) Use and disclosure of any Department
			 information asset is strictly limited to the minimum information necessary to
			 perform the requested and authorized service.
(2) The organization shall have established
			 privacy and security measures that meet or exceed the standards set forth in
			 the Department's privacy and information security policies, available from the
			 Department, regarding the disclosure of an information asset.
(3) The organization or user shall comply
			 with all security and privacy federal and state laws, rules, and regulations
			 applicable to the access granted.
(4) The organization shall make the security
			 risk plan available to the Department for review upon request.
(5) The organization or user shall report to
			 the Department all privacy or security incidents by the user that compromise,
			 damage, or cause a loss of protection to Department information assets or
			 network and information systems. The incident report shall be made no later
			 than five business days from the date on which the user becomes aware of such
			 incident. The user shall provide the Department a written report which must
			 include the results of the incident assessment findings and resolution
			 strategies.
(6) Wrongful use of a
			 network and information system or wrongful use or disclosure of a Department
			 information asset by the organization or user may cause the immediate
			 suspension or revocation of any access granted at the sole discretion of the
			 Department without advance notice.
(7) The organization or user shall comply
			 with the Department's request for corrective action concerning a privacy or
			 security incident and with laws requiring mitigation of harm caused by the
			 unauthorized use or disclosure of confidential information, if any.
Stat. Auth.: ORS
				  409.050
Stats. Implemented: ORS
				  182.122
Oregon Administrative Rules › Chapter 407 - DEPARTMENT OF HUMAN SERVICES › Division 25 - EMPLOYMENT SERVICES › Section 407-025-0000 - Purpose and Scope

Current through Register Vol. 63, No. 7, July 1, 2024
(1) The
			 purpose of these rules (OAR 407-025-0000  through 407-025-0115) is to
			 effectuate:
(a) Executive Order 15-01 which
			 supersedes Executive Order 13-04 and outlines detailed strategies and requires
			 the Oregon Department of Human Services (Department) to work with the Oregon
			 Department of Education (ODE) to further improve Oregon's systems of designing
			 and delivering employment services to those with intellectual and developmental
			 disabilities toward fulfillment of Oregon's Employment First Policy, including
			 a significant reduction over time of state support of sheltered work and an
			 increased investment in employment services.
(b) ORS
			 427.007(1)(a),
			 as added by 2013 Senate Bill 22 Enrolled, Chapter 36, 2013 Laws, which provides
			 that individuals with intellectual and other developmental disabilities and
			 society as a whole benefit when the individuals exercise choice and
			 self-determination, living and working in the most integrated community
			 settings appropriate to their needs, with supportive services that are designed
			 and implemented consistent with the choice of the individuals regarding
			 services, providers, goals and activities.
(c) ORS
			 427.007(1)(b),
			 as added by 2013 Senate Bill 22 Enrolled, Chapter 36, 2013 Laws, which provides
			 that the employment of individuals with developmental disabilities in fully
			 integrated work settings is the highest priority over unemployment, segregated
			 employment, facility-based employment or day habilitation.
Oregon Administrative Rules › Chapter 407 - DEPARTMENT OF HUMAN SERVICES › Division 25 - EMPLOYMENT SERVICES › Section 407-025-0010 - Definitions

Current through Register Vol. 63, No. 7, July 1, 2024
As used in OAR 407-025-0000  through 407-025-0115, the following
				definitions apply:
(1) "Annual plan"
			 means the written summary a service coordinator or personal agent completes for
			 an individual who is not enrolled in the waiver or community first choice
			 services. An annual plan is not an individual support plan ("ISP") and is not a
			 plan of care for Medicaid purposes.
(2) "Career development plan" means part of
			 an ISP or annual plan regarding Office of Developmental Disability Services'
			 (ODDS) services. A career development plan identifies the individual's
			 employment goals and objectives, the persons, agencies, and providers assigned
			 to assist the individual to attain those goals, the obstacles to the individual
			 working in competitive integrated employment in an integrated employment
			 setting, and the services and supports necessary to overcome those obstacles.
			 Career development plans shall be based on person-centered planning principles.
(3) "Competitive integrated
			 employment" means work that is performed on a full-time or part-time basis
			 (including self-employment):
(a) For which an
			 individual:
(A) Is compensated at a rate
			 that:
(i) Is not less than the higher of the
			 rate specified in federal, state, or local minimum wage law, and also is not
			 less than the customary rate paid by the employer for the same or similar work
			 performed by other employees who are not individuals with disabilities, and who
			 are similarly situated in similar occupations by the same employer and who have
			 similar training, experience, and skills; or
(ii) In the case of an individual who is
			 self-employed, yields an income that is comparable to the income received by
			 other individuals who are not individuals with disabilities, and who are
			 self-employed in similar occupations or on similar tasks and who have similar
			 training experience, and skills; and
Oregon Administrative Rules › Chapter 407 - DEPARTMENT OF HUMAN SERVICES › Division 25 - EMPLOYMENT SERVICES › Section 407-025-0020 - Sheltered Workshops

Current through Register Vol. 63, No. 7, July 1, 2024
(1)
			 Effective July 1, 2014, ODDS and VR shall no longer purchase or fund vocational
			 assessments for individuals with I/DD that occur in sheltered workshop
			 settings.
(2) Effective July 1,
			 2015, ODDS and VR shall no longer purchase or fund sheltered workshop
			 placements for:
(a) Transition-age
			 individuals with I/DD;
(b) Any
			 working age individual with I/DD newly eligible for ODDS or VR services; and
(c) Any working age individual
			 with I/DD already utilizing ODDS or VR services who is not already working in a
			 sheltered workshop.
Oregon Administrative Rules › Chapter 407 - DEPARTMENT OF HUMAN SERVICES › Division 25 - EMPLOYMENT SERVICES › Section 407-025-0030 - Employment Services Provided through ODDS and VR

Current through Register Vol. 63, No. 7, July 1, 2024
(1) ODDS and VR will provide employment
			 services as described in section (6) of this rule to at least 7000 unique
			 individuals in the ODDS/VR target population, including sheltered workshop
			 workers who wish to receive those employment services, between July 1, 2013 and
			 July 1, 2022, in accordance with the following schedule:
(a) By July 1, 2014, to at least 600
			 individuals.
(b) By July 1, 2015,
			 to at least 1,350 individuals.
(c)
			 By July 1, 2016, to at least 2,200 individuals.
(d) By July 1, 2017, to at least 3,000
			 individuals.
(e) By July 1, 2018,
			 to at least 3,800 individuals.
(f)
			 By July 1, 2019, to at least 4,600 individuals.
(g) By July 1, 2020, to at least 5,400
			 individuals.
(h) By July 1, 2021,
			 to at least 6,200 individuals.
(i)
			 By July 1, 2022, to at least 7,000 individuals.
Oregon Administrative Rules › Chapter 407 - DEPARTMENT OF HUMAN SERVICES › Division 25 - EMPLOYMENT SERVICES › Section 407-025-0040 - General Policies

Current through Register Vol. 63, No. 7, July 1, 2024
ODDS and VR shall establish and implement a policy that
				employment services shall be evidence-based and individualized. Employment
				services shall be individualized and services shall be individually planned,
				based on person-centered planning principles and evidence-based practices, when
				they exist. Employment services shall be based on an individual's capabilities,
				choices, and strengths and shall be individually tailored.
Stat. Auth.: ORS
				  409.050
Stats. Implemented: ORS
				  409.050
Oregon Administrative Rules › Chapter 407 - DEPARTMENT OF HUMAN SERVICES › Division 25 - EMPLOYMENT SERVICES › Section 407-025-0050 - Career Development Planning

Current through Register Vol. 63, No. 7, July 1, 2024
(1)
			 No later than January 1, 2014, ODDS shall adopt and implement policies and
			 procedures for developing career development plans. The policies must include a
			 presumption that all individuals in the ODDS/VR target population are capable
			 of working in an integrated employment setting.
(2) Career development plans shall be based
			 on person-centered planning principles.
(3) The career development plan shall
			 prioritize competitive integrated employment before other employment in
			 integrated employment settings. The career development process shall focus on
			 the strengths of the individual and shall be conducted with the goal of
			 maximizing the number of hours spent working, consistent with an individual's
			 abilities and choices.
(4) By July
			 1, 2015 sheltered workshop workers who desire to receive employment services
			 described in OAR 407-025-0030  shall receive a career development plan as part
			 of the employment services they receive under OAR 407-025-0030. Transition-age
			 individuals should have a career development plan no later than the date of
			 their anticipated departure from the Oregon public schools, but no later than
			 one year after their departure. The provision of employment services by ODDS
			 may not be delayed or denied due to the lack of a career development
			 plan.
Stat. Auth.: ORS
				  409.050
Stats. Implemented: ORS
				  409.050
Oregon Administrative Rules › Chapter 407 - DEPARTMENT OF HUMAN SERVICES › Division 25 - EMPLOYMENT SERVICES › Section 407-025-0060 - Training

Current through Register Vol. 63, No. 7, July 1, 2024
(1) Effective
			 January 1, 2014, ODDS and VR shall establish and update, when appropriate,
			 competencies for providing employment services, and shall adopt and implement
			 competency-based training standards for career development plans, job creation,
			 job development, job coaching, and coordination of those services.
(2) Effective July 1, 2016, ODDS and VR shall
			 purchase employment services for individuals with I/DD only from agencies or
			 individual providers licensed, certified, credentialed or otherwise qualified
			 as required by Department rules or contracts. The requirements for providing
			 employment services shall be competency-based and may include such national
			 credentialing programs as the APSE Certified Employment Support Professional
			 exam or a substantial equivalent.
Stat. Auth.: ORS
				  409.050
Stats. Implemented: ORS
				  409.050
Oregon Administrative Rules › Chapter 407 - DEPARTMENT OF HUMAN SERVICES › Division 25 - EMPLOYMENT SERVICES › Section 407-025-0070 - Outreach and Awareness

Current through Register Vol. 63, No. 7, July 1, 2024
Effective January 1, 2014, ODDS and VR shall develop, and
				update when appropriate, an outreach and informational education program for
				all individuals in the target population that explains the benefits of
				employment, addresses concerns of families and perceived obstacles to
				participating in employment services, and is designed to encourage individuals
				with I/DD and their families to seek employment services.
Stat. Auth.: ORS
				  409.050
Stats. Implemented: ORS
				  409.050
Oregon Administrative Rules › Chapter 407 - DEPARTMENT OF HUMAN SERVICES › Division 25 - EMPLOYMENT SERVICES › Section 407-025-0080 - Provider Capacity

Current through Register Vol. 63, No. 7, July 1, 2024
The Department shall make good faith efforts, within available
				budgetary resources, to ensure that there are a sufficient number of qualified
				employment providers to deliver the services and supports necessary for
				individuals in the ODDS/VR target population to receive employment services
				consistent with the terms of the Department's integrated employment
				rules.
Stat. Auth.: ORS
				  409.050
Stats. Implemented: ORS
				  409.050
Oregon Administrative Rules › Chapter 407 - DEPARTMENT OF HUMAN SERVICES › Division 25 - EMPLOYMENT SERVICES › Section 407-025-0090 - Director Actions

Current through Register Vol. 63, No. 7, July 1, 2024
(1)
			 Effective January 1, 2014, the Department shall designate a statewide
			 employment coordinator to oversee and coordinate its employment services
			 program and all activities required by the Department, ODDS, or VR under the
			 Department's integrated employment rules.
(2) Effective January 1, 2014, the Department
			 shall support new or existing technical assistance provider(s) or use other
			 available training resources to provide leadership, training and technical
			 assistance to employment providers and to provider, county, support services
			 brokerage, and vocational rehabilitation staff to support the performance of
			 the Department's integrated employment rules.
(3) Effective November 1, 2013, the
			 Department shall adopt an integrated employment plan to further carry out the
			 goals of the Department's integrated employment rules. The Department and the
			 policy group, as defined in OAR 407-025-0010, shall review the plan at least
			 annually, and update the integrated employment plan as appropriate.
(4) ODDS shall include specific provisions in
			 its contracts with each support services brokerage and each community
			 developmental disability program (CDDP) to accomplish the full implementation
			 of the Department's integrated employment rules.
Stat. Auth.: ORS
				  409.050
Stats. Implemented: ORS
				  409.050
Oregon Administrative Rules › Chapter 407 - DEPARTMENT OF HUMAN SERVICES › Division 25 - EMPLOYMENT SERVICES › Section 407-025-0100 - Quality Assessment and Improvement

Current through Register Vol. 63, No. 7, July 1, 2024
Effective July 1, 2014, the Department shall develop, implement
				and update, as appropriate, a quality improvement plan that is designed to
				promote employment services developed in accordance with the Department's
				integrated employment rules and to evaluate the quality of employment services
				provided to persons with I/DD under the Department's integrated employment
				rules statewide.
Stat. Auth.: ORS
				  409.050
Stats. Implemented: ORS
				  409.050
Oregon Administrative Rules › Chapter 407 - DEPARTMENT OF HUMAN SERVICES › Division 25 - EMPLOYMENT SERVICES › Section 407-025-0110 - Data Collection and Reporting

Current through Register Vol. 63, No. 7, July 1, 2024
(1) Effective January 1, 2014, and
			 semi-annually thereafter, the employment coordinator shall monitor the progress
			 of implementation of the Department's integrated employment plan through data
			 collection, data analysis, and quality improvement activities.
(2) Effective January 1, 2014, and
			 semi-annually thereafter, ODDS and VR shall collect data and report to the
			 employment coordinator and the policy group the following data for working age
			 individuals in the ODDS/VR target populations:
(a) The number of individuals receiving
			 employment services;
(b) The
			 number of persons working in the following settings: competitive integrated
			 employment, self-employment, sheltered employment, and small group employment
			 (8 or fewer);
(c) The number of
			 individuals in supported employment;
(d) The number of hours worked per week and
			 hourly wages paid to those persons;
(e) The outcomes of employment services
			 selected by individuals through the career development planning process,
			 including the selection of non-employment services;
(f) Complaints and grievances; and
(g) The number of individuals receiving
			 related employment services.
Oregon Administrative Rules › Chapter 407 - DEPARTMENT OF HUMAN SERVICES › Division 25 - EMPLOYMENT SERVICES › Section 407-025-0115 - Policy Group

Current through Register Vol. 63, No. 7, July 1, 2024
(1) A policy
			 group consisting of representatives of the Oregon Department of Education, the
			 Department, legislators, and stakeholders shall be formed to make
			 recommendations to the Director and the Deputy Superintendent of Public
			 Instruction regarding design and implementation on issues including but not
			 limited to education, outreach, development of provider capacity, training, and
			 processes for assessment and discovery.
(2) The policy group shall recommend outcome
			 metrics to the State, review the state's performance under those metrics, and
			 make annual recommendations to the Governor for improving performance. Metrics
			 developed by the policy group shall not create enforceable rights.
Stat. Auth.: ORS
				  409.050
Stats. Implemented: ORS
				  409.050
Oregon Administrative Rules › Chapter 407 - DEPARTMENT OF HUMAN SERVICES › Division 30 - CLIENT CIVIL RIGHTS › Section 407-030-0010 - Purpose

Current through Register Vol. 63, No. 7, July 1, 2024
This rule requires Divisions of the Department of Human
				Services to insure federal civil rights regulations prohibiting discrimination
				on the basis of race, color, national origin and handicap. It provides
				authority enabling Divisions of the Department of Human Services to conduct
				compliance reviews of certain of its grantees, contractors, or providers of
				services, as required by the United States Department of Health and Human
				Services (DHHS). Only those Divisions which receive DHHS funds will conduct
				reviews annually on ten of their grantees, contractors, or providers of
				services. The compliance reviews will insure that the following federal
				regulations are being followed:
(1)
			 Title VI, Civil Rights Act of 1964. This act prohibits discrimination on the
			 basis of race, color, and national origin by federal recipients.
(2) Section 504, Rehabilitation Act of 1973.
			 This act prohibits discrimination on the basis of handicap by federal
			 recipients.
Stat. Authority: ORS
				  409.050,
				  411.060
Stats. Implemented: ORS
				  409.050,
				  411.060