Chapter 86 Oregon Laws 2003

AN ACT

HB 2305

Relating to health information; creating new provisions; amending ORS 197.667, 353.117, 433.009, 433.096, 433.280, 441.117 and 634.550; repealing ORS 192.525 and 192.530; and declaring an emergency.

Be It Enacted by the People of the State of Oregon:

SECTION 1. (1) It is the policy of the State of Oregon that an individual has:

(a) The right to have protected health information of the individual safeguarded from unlawful use or disclosure; and

(b) The right to access and review protected health information of the individual.

(2) In addition to the rights and obligations expressed in sections 1 to 7 of this 2003 Act, the federal Health Insurance Portability and Accountability Act privacy regulations, 45 C.F.R. parts 160 and 164, establish additional rights and obligations regarding the use and disclosure of protected health information and the rights of individuals regarding the protected health information of the individual.

SECTION 2. As used in sections 1 to 7 of this 2003 Act:

(1) “Authorization” means a document written in plain language that contains at least the following:

(a) A description of the information to be used or disclosed that identifies the information in a specific and meaningful way;

(b) The name or other specific identification of the person or persons authorized to make the requested use or disclosure;

(c) The name or other specific identification of the person or persons to whom the covered entity may make the requested use or disclosure;

(d) A description of each purpose of the requested use or disclosure, including but not limited to a statement that the use or disclosure is at the request of the individual;

(e) An expiration date or an expiration event that relates to the individual or the purpose of the use or disclosure;

(f) The signature of the individual or personal representative of the individual and the date;

(g) A description of the authority of the personal representative, if applicable; and

(h) Statements adequate to place the individual on notice of the following:

(A) The individual’s right to revoke the authorization in writing;

(B) The exceptions to the right to revoke the authorization;

(C) The ability or inability to condition treatment, payment, enrollment or eligibility for benefits on whether the individual signs the authorization; and

(D) The potential for information disclosed pursuant to the authorization to be subject to redisclosure by the recipient and no longer protected.

(2) “Covered entity” means:

(a) A state health plan;

(b) A health insurer;

(c) A health care provider that transmits any health information in electronic form to carry out financial or administrative activities in connection with a transaction covered by sections 1 to 7 of this 2003 Act; or

(d) A health care clearinghouse.

(3) “Health care” means care, services or supplies related to the health of an individual.

(4) “Health care operations” includes but is not limited to:

(a) Quality assessment, accreditation, auditing and improvement activities;

(b) Case management and care coordination;

(c) Reviewing the competence, qualifications or performance of health care providers or health insurers;

(d) Underwriting activities;

(e) Arranging for legal services;

(f) Business planning;

(g) Customer services;

(h) Resolving internal grievances;

(i) Creating de-identified information; and

(j) Fundraising.

(5) “Health care provider” includes but is not limited to:

(a) A psychologist, occupational therapist, clinical social worker, professional counselor or marriage and family therapist licensed under ORS chapter 675 or an employee of the psychologist, occupational therapist, clinical social worker, professional counselor or marriage and family therapist;

(b) A physician, podiatric physician and surgeon, physician assistant or acupuncturist licensed under ORS chapter 677 or an employee of the physician, podiatric physician and surgeon, physician assistant or acupuncturist;

(c) A nurse or nursing home administrator licensed under ORS chapter 678 or an employee of the nurse or nursing home administrator;

(d) A dentist licensed under ORS chapter 679 or an employee of the dentist;

(e) A dental hygienist or denturist licensed under ORS chapter 680 or an employee of the dental hygienist or denturist;

(f) A speech-language pathologist or audiologist licensed under ORS chapter 681 or an employee of the speech-language pathologist or audiologist;

(g) An emergency medical technician certified under ORS chapter 682;

(h) An optometrist licensed under ORS chapter 683 or an employee of the optometrist;

(i) A chiropractic physician licensed under ORS chapter 684 or an employee of the chiropractic physician;

(j) A naturopathic physician licensed under ORS chapter 685 or an employee of the naturopathic physician;

(k) A massage therapist licensed under ORS 687.011 to 687.250 or an employee of the massage therapist;

(L) A direct entry midwife licensed under ORS 687.405 to 687.495 or an employee of the direct entry midwife;

(m) A physical therapist licensed under ORS 688.010 to 688.220 or an employee of the physical therapist;

(n) A radiologic technologist licensed under ORS 688.405 to 688.605 or an employee of the radiologic technologist;

(o) A respiratory care practitioner licensed under ORS 688.800 to 688.840 or an employee of the respiratory care practitioner;

(p) A pharmacist licensed under ORS chapter 689 or an employee of the pharmacist;

(q) A dietitian licensed under ORS 691.405 to 691.585 or an employee of the dietitian;

(r) A funeral service practitioner licensed under ORS chapter 692 or an employee of the funeral service practitioner;

(s) A health care facility as defined in ORS 442.015;

(t) A home health agency as defined in ORS 443.005;

(u) A hospice program as defined in ORS 443.850;

(v) A clinical laboratory as defined in ORS 438.010;

(w) A pharmacy as defined in ORS 689.005;

(x) A diabetes self-management program as defined in ORS 743.694; and

(y) Any other person or entity that furnishes, bills for or is paid for health care in the normal course of business.

(6) “Health information” means any oral or written information in any form or medium that:

(a) Is created or received by a covered entity, a public health authority, an employer, a life insurer, a school, a university or a health care provider that is not a covered entity; and

(b) Relates to:

(A) The past, present or future physical or mental health or condition of an individual;

(B) The provision of health care to an individual; or

(C) The past, present or future payment for the provision of health care to an individual.

(7) “Health insurer” means:

(a) An insurer as defined in ORS 731.106 who offers:

(A) A health benefit plan as defined in ORS 743.730;

(B) A short term health insurance policy, the duration of which does not exceed six months including renewals;

(C) A student health insurance policy;

(D) A Medicare supplemental policy; or

(E) A dental only policy.

(b) The Oregon Medical Insurance Pool operated by the Oregon Medical Insurance Pool Board under ORS 735.600 to 735.650.

(8) “Individually identifiable health information” means any oral or written health information in any form or medium that is:

(a) Created or received by a covered entity, an employer or a health care provider that is not a covered entity; and

(b) Identifiable to an individual, including demographic information that identifies the individual, or for which there is a reasonable basis to believe the information can be used to identify an individual, and that relates to:

(A) The past, present or future physical or mental health or condition of an individual;

(B) The provision of health care to an individual; or

(C) The past, present or future payment for the provision of health care to an individual.

(9) “Payment” includes but is not limited to:

(a) Efforts to obtain premiums or reimbursement;

(b) Determining eligibility or coverage;

(c) Billing activities;

(d) Claims management;

(e) Reviewing health care to determine medical necessity;

(f) Utilization review; and

(g) Disclosures to consumer reporting agencies.

(10) “Personal representative” includes but is not limited to:

(a) A person appointed as a guardian under ORS 125.305, 419B.370, 419C.481 or 419C.555 with authority to make medical and health care decisions;

(b) A person appointed as a health care representative under ORS 127.505 to 127.660 or a representative under ORS 127.700 to 127.737 to make health care decisions or mental health treatment decisions; and

(c) A person appointed as a personal representative under ORS chapter 113.

(11)(a) “Protected health information” means individually identifiable health information that is maintained or transmitted in any form of electronic or other medium by a covered entity.

(b) “Protected health information” does not mean individually identifiable health information in:

(A) Education records covered by the federal Family Educational Rights and Privacy Act (20 U.S.C. 1232g);

(B) Records described at 20 U.S.C. 1232g(a)(4)(B)(iv); or

(C) Employment records held by a covered entity in its role as employer.

(12) “State health plan” means:

(a) The state Medicaid program;

(b) The Oregon State Children’s Health Insurance Program; or

(c) The Family Health Insurance Assistance Program established in ORS 735.720 to 735.740.

(13) “Treatment” includes but is not limited to:

(a) The provision, coordination or management of health care; and

(b) Consultations and referrals between health care providers.

SECTION 3. A health care provider or state health plan:

(1) May use or disclose protected health information of an individual in a manner that is consistent with an authorization provided by the individual or a personal representative of the individual.

(2) May use or disclose protected health information of an individual without obtaining an authorization from the individual or a personal representative of the individual:

(a) For the provider’s or plan’s own treatment, payment or health care operations; or

(b) As otherwise permitted or required by state or federal law or by order of the court.

(3) May disclose protected health information of an individual without obtaining an authorization from the individual or a personal representative of the individual:

(a) To another covered entity for health care operations activities of the entity that receives the information if:

(A) Each entity has or had a relationship with the individual who is the subject of the protected health information; and

(B) The protected health information pertains to the relationship and the disclosure is for the purpose of:

(i) Health care operations as listed in section 2 (4)(a) or (b) of this 2003 Act; or

(ii) Health care fraud and abuse detection or compliance;

(b) To another covered entity or any other health care provider for treatment activities of a health care provider; or

(c) To another covered entity or any other health care provider for the payment activities of the entity that receives that information.

SECTION 4. A health care provider or state health plan that receives an authorization to disclose protected health information may charge:

(1) No more than $25 for copying 10 or fewer pages of written material and no more than 25 cents per page for each additional page;

(2) Postage costs to mail copies of protected health information or an explanation or summary of protected health information, if requested by an individual or a personal representative of the individual; and

(3) Actual costs of preparing an explanation or summary of protected health information, if requested by an individual or a personal representative of the individual.

SECTION 5. A health care provider may use an authorization that contains the following provisions in accordance with section 3 of this 2003 Act:

____________________________________________________________________________

AUTHORIZATION

TO USE AND DISCLOSE PROTECTED HEALTH INFORMATION

I authorize: _______________(Name of person/entity disclosing information) to use and disclose a copy of the specific health information described below regarding: _______________(Name of individual) consisting of: (Describe information to be used/disclosed)

____________________________________________________________________________

to: _______________(Name and address of recipient or recipients) for the purpose of: (Describe each purpose of disclosure or indicate that the disclosure is at the request of the individual)

____________________________________________________________________________

If the information to be disclosed contains any of the types of records or information listed below, additional laws relating to the use and disclosure of the information may apply. I understand and agree that this information will be disclosed if I place my initials in the applicable space next to the type of information.

___ HIV/AIDS information

___ Mental health information

___ Genetic testing information

___ Drug/alcohol diagnosis, treatment, or referral information.

I understand that the information used or disclosed pursuant to this authorization may be subject to redisclosure and no longer be protected under federal law. However, I also understand that federal or state law may restrict redisclosure of HIV/AIDS information, mental health information, genetic testing information and drug/alcohol diagnosis, treatment or referral information.

PROVIDER INFORMATION

You do not need to sign this authorization. Refusal to sign the authorization will not adversely affect your ability to receive health care services or reimbursement for services. The only circumstance when refusal to sign means you will not receive health care services is if the health care services are solely for the purpose of providing health information to someone else and the authorization is necessary to make that disclosure.

You may revoke this authorization in writing at any time. If you revoke your authorization, the information described above may no longer be used or disclosed for the purposes described in this written authorization. The only exception is when a covered entity has taken action in reliance on the authorization or the authorization was obtained as a condition of obtaining insurance coverage.

To revoke this authorization, please send a written statement to __________ (contact person) at __________ (address of person/entity disclosing information) and state that you are revoking this authorization.

SIGNATURE

I have read this authorization and I understand it.

Unless revoked, this authorization expires _____ (insert either applicable date or event).

By: ___________ Date: _____

(individual or personal representative)

Description of personal representative’s authority:

_______________

____________________________________________________________________________

SECTION 6. A health care provider or a state health plan does not breach a confidential relationship with an individual if the health care provider or state health plan uses or discloses protected health information in accordance with section 3 of this 2003 Act.

SECTION 7. Nothing in section 2 or 3 of this 2003 Act may be construed to create a new private right of action against a health care provider or a state health plan.

SECTION 8. ORS 192.525 and 192.530 are repealed.

SECTION 9. ORS 353.117 is amended to read:

353.117. (1) Pursuant to ORS 353.050, Oregon Health and Science University may create and maintain an entity that is exempt from federal income tax under section 501(c)(3) of the Internal Revenue Code, as amended, for the purpose of conducting clinical care and practice and advancing other university missions by the faculty.

(2) Any entity created by the university under subsection (1) of this section shall be considered:

(a) A public employer for purposes of ORS 236.605 to 236.640 and ORS chapter 238;

(b) A unit of local government for purposes of ORS 190.003 to 190.130;

[(c) A public provider of health care for purposes of ORS 192.525;]

[(d)] (c) A public body for purposes of ORS 30.260 to 30.300 and 307.112;

[(e)] (d) A public agency for purposes of ORS 200.090; and

[(f)] (e) A public corporation for purposes of ORS 307.090.

SECTION 10. ORS 433.009 is amended to read:

433.009. (1) Notwithstanding ORS 192.501 (3), 192.502 (2)[, 192.525] and 433.045, if, during the course of a criminal investigation, a law enforcement unit acquires information that the person who is charged with a crime or sentenced for a crime has a reportable disease, the law enforcement unit shall disclose that information to the public health authorities who shall confirm the diagnosis and notify any police officer, corrections officer or emergency medical technician who had significant exposure to the person.

(2) As used in this section:

(a) “Emergency medical technician” has the meaning given that term in ORS 682.025.

(b) “Law enforcement unit,” “police officer” and “corrections officer” have the meanings given those terms in ORS 181.610.

SECTION 11. ORS 433.096 is amended to read:

433.096. Nothing in ORS 179.505, 192.410 to 192.505[, 192.525, 192.530,] or 677.190 (5) or sections 1 to 7 of this 2003 Act or the client and provider privilege [shall prevent] prevents:

(1) A provider, a local health department, the Department of Human Services, the parent or guardian of a client, a school or a children’s facility from providing information to and receiving information from the immunization record of a client from the immunization registry; or

(2) The immunization registry from:

(a) Providing immunization information to or receiving immunization information from a client’s immunization record from a provider, a local health department, the Department of Human Services or the parent or guardian of a client, a school or a children’s facility;

(b) Notifying or personally contacting a client or the parent or guardian of that client about the client’s immunization status; or

SECTION 12. ORS 433.280 is amended to read:

433.280. Nothing in ORS 179.505, [192.525, 192.530,] 326.565, 326.575 or 336.187 [operates to prevent] or sections 1 to 7 of this 2003 Act prevents:

(1) Inspection by or release to administrators by local health departments of information relating to the status of a person’s immunization against restrictable diseases without the consent of the person, if the person has been emancipated or has reached the age of majority, or the parent of a child.

(2) Local health departments from releasing information concerning the status of a person’s immunization against restrictable diseases by telephone to the parent, administrators and public health officials.

SECTION 13. ORS 441.117 is amended to read:

441.117. (1) The Long Term Care Ombudsman and each designee shall have the right of entry into long term care facilities at any time considered necessary and reasonable by the ombudsman or the designee for the purpose of:

(a) Investigating and resolving complaints by residents or on their behalf;

(b) Interviewing residents, with their consent, in private;

(d) Interviewing employees or agents of the long term care facility;

(e) Consulting regularly with the facility administration; and

(f) Providing services authorized by law or by rule.

(2) The Long Term Care Ombudsman shall have access to any resident’s records, and to records of any public agency necessary to the duties of the office, including records on patient abuse complaints made pursuant to ORS 441.630 to 441.680 and 441.995. Nothing contained in [ORS 192.525 or 192.530] sections 1 to 7 of this 2003 Act is intended to limit the access of the Long Term Care Ombudsman to medical records of residents of long term care facilities. Designees may have access to individual resident’s records, including medical records as authorized by the resident or resident’s legal representative, if needed to investigate a complaint.

(3) Entry and investigation authorized by this section shall be done in a manner that does not disrupt significantly the providing of nursing or other personal care to residents.

(4) The ombudsman or the designee must show identification to the person in charge of the facility. The resident shall have the right to refuse to communicate with the ombudsman or designee. The refusal shall be made directly to the ombudsman or designee and not through an intermediary.

(5) The resident shall have the right to participate in planning any course of action to be taken on behalf of the resident by the ombudsman or the designee.

SECTION 14. ORS 634.550 is amended to read:

634.550. (1) There is created a Pesticide Analytical and Response Center with a governing board consisting of the following members:

(a) The Director of Agriculture or designee.

(b) The State Forester or designee.

(d) The Director of the Department of Environmental Quality or designee.

(e) The Director of Human Services or designee.

(f) The Administrator of the Occupational Safety and Health Division or designee.

(g) The State Fire Marshal or designee.

(h) The Director of the Poison Control and Drug Information Program of the Oregon Health and Science University or designee.

(i) One citizen from the state at large appointed jointly by the Director of Agriculture and the Director of Human Services.

(2) The Director of Agriculture shall appoint an administrator for the Pesticide Analytical and Response Center, who shall be responsible to the board for performance of the duties of the center and the board.

(3) The Director of Agriculture or designee and the Director of Human Services or designee shall alternate as chairperson of the board for terms of one year each. When one is serving as chairperson, the other shall serve as vice chairperson.

(4) The board shall seek expert consultation from the extension service toxicology program, the Center for Research on Occupational and Environmental Toxicology and such other sources as may be needed.

(5) The functions of the board are to:

(a) Direct the activities and priorities of the administrator of the center.

(b) Centralize receiving of information relating to actual or alleged health and environmental incidents involving pesticides.

(c) Mobilize expertise necessary for timely and accurate investigation of pesticide incidents and analyses of associated samples.

(d) Identify trends and patterns of problems related to pesticide use.

(e) Make recommendations for action to a state agency when a majority of the board considers that such action may be warranted on the basis of the findings of an incident investigation or on the basis of identification of a trend or pattern of problems. Recommended actions may include, but not be limited to, regulatory action, modification of administrative rules, proposal of new legislation, public education and consultation to industry.

(f) Report in a standardized format the results of the investigations of pesticide incidents.

(g) Establish by consensus, procedures for carrying out its responsibilities within the limits of available resources.

(h) Prepare and submit to each session of the Legislative Assembly a report of the activities of the center that includes a record of recommendations made by the board and the actions resulting from the board’s work.

(6) Upon receipt of a recommendation from the board, a state agency shall respond in a timely manner to inform the board of actions taken or the reasons for taking no action on the recommendation.

(7) Any medical information received by a member of the board or by a staff member of the center in the course of carrying out the duties of the center or the board shall be held confidential as provided in ORS [192.525 and] 433.008 and sections 1 to 7 of this 2003 Act.

(8) The functions of the board do not supersede the regulatory authority of any agency and are not in lieu of the regulatory authority of any agency.

SECTION 15. ORS 197.667 is amended to read:

197.667. (1) A residential facility shall be a permitted use in any zone where multifamily residential uses are a permitted use.

(2) A residential facility shall be a conditional use in any zone where multifamily residential uses are a conditional use.

(3) A city or county may allow a residential facility in a residential zone other than those zones described in subsections (1) and (2) of this section, including a zone where a single-family dwelling is allowed.

(4) A city or county may require an applicant proposing to site a residential facility within its jurisdiction to supply the city or county with a copy of the entire application and supporting documentation for state licensing of the facility, except for information which is exempt from public disclosure under ORS [192.496 to 192.530] 192.410 to 192.505. However, cities and counties shall not require independent proof of the same conditions that have been required by the Department of Human Services under ORS 418.205 to 418.327 for licensing of a residential facility.

SECTION 16. Notwithstanding ORS 1.735, the amendments to ORCP 44 E and 55 H and the repeal of ORCP 55 I as promulgated by the Council on Court Procedures on December 14, 2002, become effective on the effective date of this 2003 Act.

SECTION 17. This 2003 Act being necessary for the immediate preservation of the public peace, health and safety, an emergency is declared to exist, and this 2003 Act takes effect on its passage.

Approved by the Governor May 24, 2003

Filed in the office of Secretary of State May 27, 2003

Effective date May 24, 2003

__________