Title 192 · ORS Chapter 192

192.518] �� Note: 192.553 to 192.581 were enacted into law by the Legislative Assembly but were not added to or made a part of ORS chapter 192 or any series therein by legislative action. See P

Citation: ORS 192.518

Section: 192.518

192.518]

�� Note: 192.553 to 192.581 were enacted into law by the Legislative Assembly but were not added to or made a part of ORS chapter 192 or any series therein by legislative action. See Preface to Oregon Revised Statutes for further explanation.

�� 192.555 [1977 c.517 ��2,8(1); 1985 c.565 �24; 1987 c.373 �25; 1987 c.438 �4; 1993 c.131 �3; 1993 c.274 �1; 1993 c.695 �1; 1997 c.142 �1; 1999 c.80 �68; 1999 c.506 �5; 2009 c.541 �8; renumbered 192.586 in 2011]

�� 192.556 Definitions for ORS 192.553 to 192.581. As used in ORS 192.553 to 192.581:

�� (1) �Authorization� means a document written in plain language that contains at least the following:

�� (a) A description of the information to be used or disclosed that identifies the information in a specific and meaningful way;

�� (b) The name or other specific identification of the person or persons authorized to make the requested use or disclosure;

�� (c) The name or other specific identification of the person or persons to whom the covered entity may make the requested use or disclosure;

�� (d) A description of each purpose of the requested use or disclosure, including but not limited to a statement that the use or disclosure is at the request of the individual;

�� (e) An expiration date or an expiration event that relates to the individual or the purpose of the use or disclosure;

�� (f) The signature of the individual or personal representative of the individual and the date;

�� (g) A description of the authority of the personal representative, if applicable; and

�� (h) Statements adequate to place the individual on notice of the following:

�� (A) The individual�s right to revoke the authorization in writing;

�� (B) The exceptions to the right to revoke the authorization;

�� (C) The ability or inability to condition treatment, payment, enrollment or eligibility for benefits on whether the individual signs the authorization; and

�� (D) The potential for information disclosed pursuant to the authorization to be subject to redisclosure by the recipient and no longer protected.

�� (2) �Covered entity� means:

�� (a) A state health plan;

�� (b) A health insurer;

�� (c) A health care provider that transmits any health information in electronic form to carry out financial or administrative activities in connection with a transaction covered by ORS 192.553 to 192.581; or

�� (d) A health care clearinghouse.

�� (3) �Health care� means care, services or supplies related to the health of an individual.

�� (4) �Health care operations� includes but is not limited to:

�� (a) Quality assessment, accreditation, auditing and improvement activities;

�� (b) Case management and care coordination;

�� (c) Reviewing the competence, qualifications or performance of health care providers or health insurers;

�� (d) Underwriting activities;

�� (e) Arranging for legal services;

�� (f) Business planning;

�� (g) Customer services;

�� (h) Resolving internal grievances;

�� (i) Creating deidentified information; and

�� (j) Fundraising.

�� (5) �Health care provider� includes but is not limited to:

�� (a) A psychologist, occupational therapist, regulated social worker, professional counselor or marriage and family therapist licensed or otherwise authorized to practice under ORS chapter 675 or an employee of the psychologist, occupational therapist, regulated social worker, professional counselor or marriage and family therapist;

�� (b) A physician or physician associate licensed under ORS chapter 677, an acupuncturist licensed under ORS 677.759 or an employee of the physician, physician associate or acupuncturist;

�� (c) A nurse or nursing home administrator licensed under ORS chapter 678 or an employee of the nurse or nursing home administrator;

�� (d) A dentist licensed under ORS chapter 679 or an employee of the dentist;

�� (e) A dental hygienist or denturist licensed under ORS chapter 680 or an employee of the dental hygienist or denturist;

�� (f) A speech-language pathologist or audiologist licensed under ORS chapter 681 or an employee of the speech-language pathologist or audiologist;

�� (g) An emergency medical services provider licensed under ORS chapter 682;

�� (h) An optometrist licensed under ORS chapter 683 or an employee of the optometrist;

�� (i) A chiropractic physician licensed under ORS chapter 684 or an employee of the chiropractic physician;

�� (j) A naturopathic physician licensed under ORS chapter 685 or an employee of the naturopathic physician;

�� (k) A massage therapist licensed under ORS 687.011 to 687.250 or an employee of the massage therapist;

�� (L) A direct entry midwife licensed under ORS 687.405 to 687.495 or an employee of the direct entry midwife;

�� (m) A physical therapist licensed under ORS 688.010 to 688.201 or an employee of the physical therapist;

�� (n) A medical imaging licensee under ORS 688.405 to 688.605 or an employee of the medical imaging licensee;

�� (o) A respiratory care practitioner licensed under ORS 688.815 or an employee of the respiratory care practitioner;

�� (p) A polysomnographic technologist licensed under ORS 688.819 or an employee of the polysomnographic technologist;

�� (q) A pharmacist licensed under ORS chapter 689 or an employee of the pharmacist;

�� (r) A dietitian licensed under ORS 691.405 to 691.485 or an employee of the dietitian;

�� (s) A funeral service practitioner licensed under ORS chapter 692 or an employee of the funeral service practitioner;

�� (t) A health care facility as defined in ORS 442.015;

�� (u) A home health agency as defined in ORS 443.014;

�� (v) A hospice program as defined in ORS 443.850;

�� (w) A clinical laboratory as defined in ORS 438.010;

�� (x) A pharmacy as defined in ORS 689.005; and

�� (y) Any other person or entity that furnishes, bills for or is paid for health care in the normal course of business.

�� (6) �Health information� means any oral or written information in any form or medium that:

�� (a) Is created or received by a covered entity, a public health authority, an employer, a life insurer, a school, a university or a health care provider that is not a covered entity; and

�� (b) Relates to:

�� (A) The past, present or future physical or mental health or condition of an individual;

�� (B) The provision of health care to an individual; or

�� (C) The past, present or future payment for the provision of health care to an individual.

�� (7) �Health insurer� means an insurer as defined in ORS 731.106 who offers:

�� (a) A health benefit plan as defined in ORS 743B.005;

�� (b) A short term health insurance policy, the duration of which does not exceed three months including renewals;

�� (c) A student health insurance policy;

�� (d) A Medicare supplemental policy; or

�� (e) A dental only policy.

�� (8) �Individually identifiable health information� means any oral or written health information in any form or medium that is:

�� (a) Created or received by a covered entity, an employer or a health care provider that is not a covered entity; and

�� (b) Identifiable to an individual, including demographic information that identifies the individual, or for which there is a reasonable basis to believe the information can be used to identify an individual, and that relates to:

�� (A) The past, present or future physical or mental health or condition of an individual;

�� (B) The provision of health care to an individual; or

�� (C) The past, present or future payment for the provision of health care to an individual.

�� (9) �Payment� includes but is not limited to:

�� (a) Efforts to obtain premiums or reimbursement;

�� (b) Determining eligibility or coverage;

�� (c) Billing activities;

�� (d) Claims management;

�� (e) Reviewing health care to determine medical necessity;

�� (f) Utilization review; and

�� (g) Disclosures to consumer reporting agencies.

�� (10) �Personal representative� includes but is not limited to:

�� (a) A person appointed as a guardian under ORS 125.305, 419B.372, 419C.481 or 419C.555 with authority to make medical and health care decisions;

�� (b) A person appointed as a health care representative under ORS 127.505 to 127.660 or a representative under ORS 127.700 to 127.737 to make health care decisions or mental health treatment decisions;

�� (c) A person appointed as a personal representative under ORS chapter 113; and

�� (d) A person described in ORS 192.573.

�� (11)(a) �Protected health information� means individually identifiable health information that is maintained or transmitted in any form of electronic or other medium by a covered entity.

�� (b) �Protected health information� does not mean individually identifiable health information in:

�� (A) Education records covered by the federal Family Educational Rights and Privacy Act (20 U.S.C. 1232g);

�� (B) Records described at 20 U.S.C. 1232g(a)(4)(B)(iv); or

�� (C) Employment records held by a covered entity in its role as employer.

�� (12) �State health plan� means:

�� (a) Medical assistance as defined in ORS 414.025;

�� (b) The Cover All People program; or

�� (c) Any medical assistance or premium assistance program operated by the Oregon Health Authority.

�� (13) �Treatment� includes but is not limited to:

�� (a) The provision, coordination or management of health care; and

�� (b) Consultations and referrals between health care providers. [Formerly 192.519; 2013 c.129 �24; 2013 c.681 �42; 2013 c.698 �30; 2017 c.152 ��1,2; 2017 c.206 ��12,13; 2021 c.554 �3; 2024 c.73 �47]

�� Note: See note under 192.553.

�� 192.557 [1987 c.438 �2; 1999 c.80 �69; 2003 c.73 �59; renumbered 192.588 in 2011]

�� 192.558 Use or disclosure by health care provider or state health plan. A health care provider or state health plan:

�� (1) May use or disclose protected health information of an individual in a manner that is consistent with an authorization provided by the individual or a personal representative of the individual.

�� (2) May use or disclose protected health information of an individual without obtaining an authorization from the individual or a personal representative of the individual:

�� (a) For the provider�s or plan�s own treatment, payment or health care operations; or

�� (b) As otherwise permitted or required by state or federal law or by order of the court.

�� (3) May disclose protected health information of an individual without obtaining an authorization from the individual or a personal representative of the individual:

�� (a) To another covered entity for health care operations activities of the entity that receives the information if:

�� (A) Each entity has or had a relationship with the individual who is the subject of the protected health information; and

�� (B) The protected health information pertains to the relationship and the disclosure is for the purpose of:

�� (i) Health care operations as listed in ORS 192.556 (4)(a) or (b); or

�� (ii) Health care fraud and abuse detection or compliance;

�� (b) To another covered entity or any other health care provider for treatment activities of a health care provider;

�� (c) To another covered entity or any other health care provider for the payment activities of the entity that receives that information; or

�� (d) In accordance with ORS 192.567 or 192.577. [Formerly 192.520; 2015 c.473 �5; 2017 c.484 �4]

�� Note: See note under 192.553.

�� 192.559 [1991 c.825 �2; 1993 c.274 �2; 2001 c.962 �82; renumbered 192.591 in 2011]

�� 192.560 [1977 c.517 �3; renumbered 192.593 in 2011]

�� 192.561 Disclosure by health care provider in coordinated care organization. (1) Notwithstanding ORS 179.505, a health care provider that is a participant in a coordinated care organization, as defined in ORS 414.025, shall disclose protected health information:

�� (a) To other health care providers participating in the coordinated care organization for treatment purposes, and to the coordinated care organization for health care operations and payment purposes, as permitted by ORS 192.558; and

�� (b) To public health entities as required for health oversight purposes.

�� (2) The disclosures described in subsection (1) of this section may be provided without the authorization of the patient or the patient�s personal representative.

�� (3) Subsection (1) of this section does not apply to psychotherapy notes, as defined in ORS