2017 ORS 192.558¹
Use or disclosure by health care provider or state health plan

A health care provider or state health plan:

(1) May use or disclose protected health information of an individual in a manner that is consistent with an authorization provided by the individual or a personal representative of the individual.

(2) May use or disclose protected health information of an individual without obtaining an authorization from the individual or a personal representative of the individual:

(a) For the provider’s or plan’s own treatment, payment or health care operations; or

(b) As otherwise permitted or required by state or federal law or by order of the court.

(3) May disclose protected health information of an individual without obtaining an authorization from the individual or a personal representative of the individual:

(a) To another covered entity for health care operations activities of the entity that receives the information if:

(A) Each entity has or had a relationship with the individual who is the subject of the protected health information; and

(B) The protected health information pertains to the relationship and the disclosure is for the purpose of:

(i) Health care operations as listed in ORS 192.556 (Definitions for ORS 192.553 to 192.581) (4)(a) or (b); or

(ii) Health care fraud and abuse detection or compliance;

(b) To another covered entity or any other health care provider for treatment activities of a health care provider;

(c) To another covered entity or any other health care provider for the payment activities of the entity that receives that information; or

(d) In accordance with ORS 192.567 (Disclosure without authorization form) or 192.577 (Disclosure of Department of Corrections inmate information). [Formerly 192.520; 2015 c.473 §5; 2017 c.484 §4]

Note: See note under 192.553 (Policy for protected health information).

(formerly 192.520)

Notes of Decisions

Under Former Similar Statute (Ors 192.525)

Defendant hospital’s duty of confidentiality did not extend beyond patient to patient’s family where facts disclosed did not concern family and did not arise out of any family involve­ment in patient’s treat­ment. Doe v. Portland Health Centers, Inc., 99 Or App 423, 782 P2d 446 (1989)

Chapter 192

Atty. Gen. Opinions

Attorney General’s Public Meetings and Records Manual, (1973) Vol 36, p 543; public meetings and records manual, (1976) Vol 37, p 1087; pro­hi­bi­­tion on disclosing marriage records, (1998) Vol 49, p 21

1 Legislative Counsel Committee, CHAPTER 192—Records; Public Reports and Meetings, https://­www.­oregonlegislature.­gov/­bills_laws/­ors/­ors192.­html (2017) (last ac­cessed Mar. 30, 2018).
 
2 Legislative Counsel Committee, Annotations to the Oregon Revised Stat­utes, Cumulative Supplement - 2017, Chapter 192, https://­www.­oregonlegislature.­gov/­bills_laws/­ors/­ano192.­html (2017) (last ac­cessed Mar. 30, 2018).
 
3 OregonLaws.org assembles these lists by analyzing references between Sections. Each listed item refers back to the current Section in its own text. The result reveals relationships in the code that may not have otherwise been apparent.