Oregon Administrative Rules › Chapter 410 - OREGON HEALTH AUTHORITY, HEALTH SYSTEMS DIVISION: MEDICAL ASSISTANCE PROGRAMS › Division 141 - OREGON HEALTH PLAN › Section 410-141-3520 - Record Keeping and Use of Health Information Technology

Current through Register Vol. 63, No. 7, July 1, 2024
(1) MCEs shall have
			 written policies and procedures that ensure maintenance of a record keeping
			 system that includes maintaining the security of records as required by the
			 Health Insurance Portability and Accountability Act (HIPAA),
			 42 USC §
									1320 -d et seq., the federal regulations
			 implementing the Act, and complete clinical records that document the
			 coordinated care services received by the members. MCEs shall communicate these
			 policies and procedures to subcontractors. MCEs shall regularly monitor its
			 subcontractors' compliance and take any corrective action necessary. MCEs shall
			 document all monitoring and corrective action activities. These policies and
			 procedures shall ensure that records are secured, safeguarded, and stored in
			 accordance with applicable Oregon Revised Statutes and Oregon Administrative
			 Rules. A member must have access to the member's personal health information in
			 the manner provided in
			 45 C.F.R.
			 164.524 and ORS
			 179.505(9) so
			 the member may share the information with others involved in the member's care
			 and make better health care and lifestyle choices.
(2) MCE's participating providers may charge
			 the member for reasonable duplication costs, as set forth in OAR 943-014-0030,
			 when the member requests copies of their records.
(3) Notwithstanding ORS
			 179.505, an MCE, its provider
			 network, and programs administered by the Department's Aging and People with
			 Disabilities shall use and disclose member information for purposes of service
			 and care delivery, coordination, service planning, transitional services, and
			 reimbursement in order to improve the safety and quality of care, lower the
			 cost of care, and improve the health and well-being of the members.
(4) An MCE and its provider network shall use
			 and disclose sensitive diagnosis information including HIV and other health and
			 behavioral health diagnoses within the MCE for the purpose of providing
			 whole-person care. Individually identifiable health information must be treated
			 as confidential and privileged information subject to ORS
			 192.553 to
			 192.581 and applicable federal
			 privacy requirements. Re-disclosure of individually identifiable information
			 outside of the MCE and the MCE's providers for purposes unrelated to this
			 section or the requirements of ORS
			 414.625,
			 414.632,
			 414.635,
			 414.638,
			 414.653 and
			 414.655 remains subject to any
			 applicable federal or state privacy requirements including the Authority's
			 rules established in OAR 943-014-0000  through 0070 for matters that involve
			 privacy and confidentiality and privacy of members protected
			 information.
(5) The MCE must
			 document its methods and findings to ensure across the organization and the
			 network of providers there is documentation of the coordinated care services
			 and supports, including transitions of care and access to preventive and
			 wellness services.
(6) MCEs shall
			 support the adoption and use of electronic health records (EHRs) by its
			 provider network, including physical, behavioral, and oral health providers. To
			 achieve EHR adoption, MCEs shall:
(a)
			 Identify EHR adoption rates, divided by provider type (at a minimum, divided by
			 physical, behavioral, and oral health) and geographic region if
			 applicable;
(b) Develop and
			 implement strategies to increase adoption rates of EHRs among all provider
			 types; and
(c) Support EHR
			 adoption.