ORS 192.556
Definitions for ORS 192.553 to 192.581
(1)
“Authorization” means a document written in plain language that contains at least the following:(a)
A description of the information to be used or disclosed that identifies the information in a specific and meaningful way;(b)
The name or other specific identification of the person or persons authorized to make the requested use or disclosure;(c)
The name or other specific identification of the person or persons to whom the covered entity may make the requested use or disclosure;(d)
A description of each purpose of the requested use or disclosure, including but not limited to a statement that the use or disclosure is at the request of the individual;(e)
An expiration date or an expiration event that relates to the individual or the purpose of the use or disclosure;(f)
The signature of the individual or personal representative of the individual and the date;(g)
A description of the authority of the personal representative, if applicable; and(h)
Statements adequate to place the individual on notice of the following:(A)
The individual’s right to revoke the authorization in writing;(B)
The exceptions to the right to revoke the authorization;(C)
The ability or inability to condition treatment, payment, enrollment or eligibility for benefits on whether the individual signs the authorization; and(D)
The potential for information disclosed pursuant to the authorization to be subject to redisclosure by the recipient and no longer protected.(2)
“Covered entity” means:(a)
A state health plan;(b)
A health insurer;(c)
A health care provider that transmits any health information in electronic form to carry out financial or administrative activities in connection with a transaction covered by ORS 192.553 (Policy for protected health information) to 192.581 (Allowed retention or disclosure of genetic information); or(d)
A health care clearinghouse.(3)
“Health care” means care, services or supplies related to the health of an individual.(4)
“Health care operations” includes but is not limited to:(a)
Quality assessment, accreditation, auditing and improvement activities;(b)
Case management and care coordination;(c)
Reviewing the competence, qualifications or performance of health care providers or health insurers;(d)
Underwriting activities;(e)
Arranging for legal services;(f)
Business planning;(g)
Customer services;(h)
Resolving internal grievances;(i)
Creating deidentified information; and(j)
Fundraising.(5)
“Health care provider” includes but is not limited to:(a)
A psychologist, occupational therapist, regulated social worker, professional counselor or marriage and family therapist licensed or otherwise authorized to practice under ORS chapter 675 or an employee of the psychologist, occupational therapist, regulated social worker, professional counselor or marriage and family therapist;(b)
A physician or physician assistant licensed under ORS chapter 677, an acupuncturist licensed under ORS 677.759 (License required) or an employee of the physician, physician assistant or acupuncturist;(c)
A nurse or nursing home administrator licensed under ORS chapter 678 or an employee of the nurse or nursing home administrator;(d)
A dentist licensed under ORS chapter 679 or an employee of the dentist;(e)
A dental hygienist or denturist licensed under ORS chapter 680 or an employee of the dental hygienist or denturist;(f)
A speech-language pathologist or audiologist licensed under ORS chapter 681 or an employee of the speech-language pathologist or audiologist;(g)
An emergency medical services provider licensed under ORS chapter 682;(h)
An optometrist licensed under ORS chapter 683 or an employee of the optometrist;(i)
A chiropractic physician licensed under ORS chapter 684 or an employee of the chiropractic physician;(j)
A naturopathic physician licensed under ORS chapter 685 or an employee of the naturopathic physician;(k)
A massage therapist licensed under ORS 687.011 (Definitions) to 687.250 (Enforcement) or an employee of the massage therapist;(L)
A direct entry midwife licensed under ORS 687.405 (“Direct entry midwifery” defined) to 687.495 (Collection of data on birth and fetal death outcomes) or an employee of the direct entry midwife;(m)
A physical therapist licensed under ORS 688.010 (Definitions for ORS 688.010 to 688.201) to 688.201 (Disposition of receipts) or an employee of the physical therapist;(n)
A medical imaging licensee under ORS 688.405 (Definitions for ORS 688.405 to 688.605) to 688.605 (Duty to report violation) or an employee of the medical imaging licensee;(o)
A respiratory care practitioner licensed under ORS 688.815 (License to practice respiratory care) or an employee of the respiratory care practitioner;(p)
A polysomnographic technologist licensed under ORS 688.819 (Polysomnographic technologist license) or an employee of the polysomnographic technologist;(q)
A pharmacist licensed under ORS chapter 689 or an employee of the pharmacist;(r)
A dietitian licensed under ORS 691.405 (Definitions for ORS 691.405 to 691.485) to 691.485 (Board of Licensed Dietitians) or an employee of the dietitian;(s)
A funeral service practitioner licensed under ORS chapter 692 or an employee of the funeral service practitioner;(t)
A health care facility as defined in ORS 442.015 (Definitions);(u)
A home health agency as defined in ORS 443.014 (Definitions for ORS 443.014 to 443.105);(v)
A hospice program as defined in ORS 443.850 (Definitions for ORS 443.850 to 443.869);(w)
A clinical laboratory as defined in ORS 438.010 (Definitions for ORS 438.010 to 438.510);(x)
A pharmacy as defined in ORS 689.005 (Definitions); and(y)
Any other person or entity that furnishes, bills for or is paid for health care in the normal course of business.(6)
“Health information” means any oral or written information in any form or medium that:(a)
Is created or received by a covered entity, a public health authority, an employer, a life insurer, a school, a university or a health care provider that is not a covered entity; and(b)
Relates to:(A)
The past, present or future physical or mental health or condition of an individual;(B)
The provision of health care to an individual; or(C)
The past, present or future payment for the provision of health care to an individual.(7)
“Health insurer” means an insurer as defined in ORS 731.106 (“Insurer.”) who offers:(a)
A health benefit plan as defined in ORS 743B.005 (Definitions);(b)
A short term health insurance policy, the duration of which does not exceed three months including renewals;(c)
A student health insurance policy;(d)
A Medicare supplemental policy; or(e)
A dental only policy.(8)
“Individually identifiable health information” means any oral or written health information in any form or medium that is:(a)
Created or received by a covered entity, an employer or a health care provider that is not a covered entity; and(b)
Identifiable to an individual, including demographic information that identifies the individual, or for which there is a reasonable basis to believe the information can be used to identify an individual, and that relates to:(A)
The past, present or future physical or mental health or condition of an individual;(B)
The provision of health care to an individual; or(C)
The past, present or future payment for the provision of health care to an individual.(9)
“Payment” includes but is not limited to:(a)
Efforts to obtain premiums or reimbursement;(b)
Determining eligibility or coverage;(c)
Billing activities;(d)
Claims management;(e)
Reviewing health care to determine medical necessity;(f)
Utilization review; and(g)
Disclosures to consumer reporting agencies.(10)
“Personal representative” includes but is not limited to:(a)
A person appointed as a guardian under ORS 125.305 (Order of appointment), 419B.372 (Guardianship as incident of custody), 419C.481 (Guardianship and legal custody of adjudicated youth committed to Oregon Youth Authority) or 419C.555 (Authority to appoint guardian) with authority to make medical and health care decisions;(b)
A person appointed as a health care representative under ORS 127.505 (Definitions for ORS 127.505 to 127.660) to 127.660 (Short title) or a representative under ORS 127.700 (Definitions for ORS 127.700 to 127.737) to 127.737 (Certain other laws applicable to declaration) to make health care decisions or mental health treatment decisions;(c)
A person appointed as a personal representative under ORS chapter 113; and(d)
A person described in ORS 192.573 (Personal representative of deceased individual).(11)
Intentionally left blank —Ed.(a)
“Protected health information” means individually identifiable health information that is maintained or transmitted in any form of electronic or other medium by a covered entity.(b)
“Protected health information” does not mean individually identifiable health information in:(A)
Education records covered by the federal Family Educational Rights and Privacy Act (20 U.S.C. 1232g);(B)
Records described at 20 U.S.C. 1232g(a)(4)(B)(iv); or(C)
Employment records held by a covered entity in its role as employer.(12)
“State health plan” means:(a)
Medical assistance as defined in ORS 414.025 (Definitions for ORS chapters 411, 413 and 414);(b)
The Cover All People program; or(c)
Any medical assistance or premium assistance program operated by the Oregon Health Authority.(13)
“Treatment” includes but is not limited to:(a)
The provision, coordination or management of health care; and(b)
Consultations and referrals between health care providers. [Formerly 192.519; 2013 c.129 §24; 2013 c.681 §42; 2013 c.698 §30; 2017 c.152 §§1,2; 2017 c.206 §§12,13; 2021 c.554 §3](1)
“Authorization” means a document written in plain language that contains at least the following:(a)
A description of the information to be used or disclosed that identifies the information in a specific and meaningful way;(b)
The name or other specific identification of the person or persons authorized to make the requested use or disclosure;(c)
The name or other specific identification of the person or persons to whom the covered entity may make the requested use or disclosure;(d)
A description of each purpose of the requested use or disclosure, including but not limited to a statement that the use or disclosure is at the request of the individual;(e)
An expiration date or an expiration event that relates to the individual or the purpose of the use or disclosure;(f)
The signature of the individual or personal representative of the individual and the date;(g)
A description of the authority of the personal representative, if applicable; and(h)
Statements adequate to place the individual on notice of the following:(A)
The individual’s right to revoke the authorization in writing;(B)
The exceptions to the right to revoke the authorization;(C)
The ability or inability to condition treatment, payment, enrollment or eligibility for benefits on whether the individual signs the authorization; and(D)
The potential for information disclosed pursuant to the authorization to be subject to redisclosure by the recipient and no longer protected.(2)
“Covered entity” means:(a)
A state health plan;(b)
A health insurer;(c)
A health care provider that transmits any health information in electronic form to carry out financial or administrative activities in connection with a transaction covered by ORS 192.553 (Policy for protected health information) to 192.581 (Allowed retention or disclosure of genetic information); or(d)
A health care clearinghouse.(3)
“Health care” means care, services or supplies related to the health of an individual.(4)
“Health care operations” includes but is not limited to:(a)
Quality assessment, accreditation, auditing and improvement activities;(b)
Case management and care coordination;(c)
Reviewing the competence, qualifications or performance of health care providers or health insurers;(d)
Underwriting activities;(e)
Arranging for legal services;(f)
Business planning;(g)
Customer services;(h)
Resolving internal grievances;(i)
Creating deidentified information; and(j)
Fundraising.(5)
“Health care provider” includes but is not limited to:(a)
A psychologist, occupational therapist, regulated social worker, professional counselor or marriage and family therapist licensed or otherwise authorized to practice under ORS chapter 675 or an employee of the psychologist, occupational therapist, regulated social worker, professional counselor or marriage and family therapist;(b)
A physician or physician assistant licensed under ORS chapter 677, an acupuncturist licensed under ORS 677.759 (License required) or an employee of the physician, physician assistant or acupuncturist;(c)
A nurse or nursing home administrator licensed under ORS chapter 678 or an employee of the nurse or nursing home administrator;(d)
A dentist licensed under ORS chapter 679 or an employee of the dentist;(e)
A dental hygienist or denturist licensed under ORS chapter 680 or an employee of the dental hygienist or denturist;(f)
A speech-language pathologist or audiologist licensed under ORS chapter 681 or an employee of the speech-language pathologist or audiologist;(g)
An emergency medical services provider licensed under ORS chapter 682;(h)
An optometrist licensed under ORS chapter 683 or an employee of the optometrist;(i)
A chiropractic physician licensed under ORS chapter 684 or an employee of the chiropractic physician;(j)
A naturopathic physician licensed under ORS chapter 685 or an employee of the naturopathic physician;(k)
A massage therapist licensed under ORS 687.011 (Definitions) to 687.250 (Enforcement) or an employee of the massage therapist;(L)
A direct entry midwife licensed under ORS 687.405 (“Direct entry midwifery” defined) to 687.495 (Collection of data on birth and fetal death outcomes) or an employee of the direct entry midwife;(m)
A physical therapist licensed under ORS 688.010 (Definitions for ORS 688.010 to 688.201) to 688.201 (Disposition of receipts) or an employee of the physical therapist;(n)
A medical imaging licensee under ORS 688.405 (Definitions for ORS 688.405 to 688.605) to 688.605 (Duty to report violation) or an employee of the medical imaging licensee;(o)
A respiratory care practitioner licensed under ORS 688.815 (License to practice respiratory care) or an employee of the respiratory care practitioner;(p)
A polysomnographic technologist licensed under ORS 688.819 (Polysomnographic technologist license) or an employee of the polysomnographic technologist;(q)
A pharmacist licensed under ORS chapter 689 or an employee of the pharmacist;(r)
A dietitian licensed under ORS 691.405 (Definitions for ORS 691.405 to 691.485) to 691.485 (Board of Licensed Dietitians) or an employee of the dietitian;(s)
A funeral service practitioner licensed under ORS chapter 692 or an employee of the funeral service practitioner;(t)
A health care facility as defined in ORS 442.015 (Definitions);(u)
A home health agency as defined in ORS 443.014 (Definitions for ORS 443.014 to 443.105);(v)
A hospice program as defined in ORS 443.850 (Definitions for ORS 443.850 to 443.869);(w)
A clinical laboratory as defined in ORS 438.010 (Definitions for ORS 438.010 to 438.510);(x)
A pharmacy as defined in ORS 689.005 (Definitions); and(y)
Any other person or entity that furnishes, bills for or is paid for health care in the normal course of business.(6)
“Health information” means any oral or written information in any form or medium that:(a)
Is created or received by a covered entity, a public health authority, an employer, a life insurer, a school, a university or a health care provider that is not a covered entity; and(b)
Relates to:(A)
The past, present or future physical or mental health or condition of an individual;(B)
The provision of health care to an individual; or(C)
The past, present or future payment for the provision of health care to an individual.(7)
“Health insurer” means an insurer as defined in ORS 731.106 (“Insurer.”) who offers:(a)
A health benefit plan as defined in ORS 743B.005 (Definitions);(b)
A short term health insurance policy, the duration of which does not exceed three months including renewals;(c)
A student health insurance policy;(d)
A Medicare supplemental policy; or(e)
A dental only policy.(8)
“Individually identifiable health information” means any oral or written health information in any form or medium that is:(a)
Created or received by a covered entity, an employer or a health care provider that is not a covered entity; and(b)
Identifiable to an individual, including demographic information that identifies the individual, or for which there is a reasonable basis to believe the information can be used to identify an individual, and that relates to:(A)
The past, present or future physical or mental health or condition of an individual;(B)
The provision of health care to an individual; or(C)
The past, present or future payment for the provision of health care to an individual.(9)
“Payment” includes but is not limited to:(a)
Efforts to obtain premiums or reimbursement;(b)
Determining eligibility or coverage;(c)
Billing activities;(d)
Claims management;(e)
Reviewing health care to determine medical necessity;(f)
Utilization review; and(g)
Disclosures to consumer reporting agencies.(10)
“Personal representative” includes but is not limited to:(a)
A person appointed as a guardian under ORS 125.305 (Order of appointment), 419B.372 (Guardianship as incident of custody), 419C.481 (Guardianship and legal custody of adjudicated youth committed to Oregon Youth Authority) or 419C.555 (Authority to appoint guardian) with authority to make medical and health care decisions;(b)
A person appointed as a health care representative under ORS 127.505 (Definitions for ORS 127.505 to 127.660) to 127.660 (Short title) or a representative under ORS 127.700 (Definitions for ORS 127.700 to 127.737) to 127.737 (Certain other laws applicable to declaration) to make health care decisions or mental health treatment decisions;(c)
A person appointed as a personal representative under ORS chapter 113; and(d)
A person described in ORS 192.573 (Personal representative of deceased individual).(11)
Intentionally left blank —Ed.(a)
“Protected health information” means individually identifiable health information that is maintained or transmitted in any form of electronic or other medium by a covered entity.(b)
“Protected health information” does not mean individually identifiable health information in:(A)
Education records covered by the federal Family Educational Rights and Privacy Act (20 U.S.C. 1232g);(B)
Records described at 20 U.S.C. 1232g(a)(4)(B)(iv); or(C)
Employment records held by a covered entity in its role as employer.(12)
“State health plan” means:(a)
Medical assistance as defined in ORS 414.025 (Definitions for ORS chapters 411, 413 and 414);(b)
The Health Care for All Oregon Children program; or(c)
Any medical assistance or premium assistance program operated by the Oregon Health Authority.(13)
“Treatment” includes but is not limited to:(a)
The provision, coordination or management of health care; and(b)
Consultations and referrals between health care providers.
Source:
Section 192.556 — Definitions for ORS 192.553 to 192.581, https://www.oregonlegislature.gov/bills_laws/ors/ors192.html
.
Notes of Decisions
Definitions of “individually identifiable health information” and “protected health information” in this section are substantively comparable to definitions of “individually identifiable health information” and “protected health information” under federal Health Insurance Portability and Accountability Act of 1996. Or. Health & Sci. Univ. v. Oregonian Publ. Co., LLC, 362 Or 68, 403 P3d 732 (2017)