2015 ORS 414.679¹
Use and disclosure of member information
  • access by member to personal health information

(1) The Oregon Health Authority shall ensure the appropriate use of member information by coordinated care organizations, including the use of electronic health information and administrative data that is available when and where the data is needed to improve health and health care through a secure, confidential health information exchange.

(2) A member of a coordinated care organization must have access to the member’s personal health information in the manner provided in 45 C.F.R. 164.524 so the member can share the information with others involved in the member’s care and make better health care and lifestyle choices.

(3) Notwithstanding ORS 179.505 (Disclosure of written accounts by health care services provider), a coordinated care organization, its provider network and programs administered by the Department of Human Services for seniors and persons with disabilities shall use and disclose member information for purposes of service and care delivery, coordination, service planning, transitional services and reimbursement, in order to improve the safety and quality of care, lower the cost of care and improve the health and well-being of the organization’s members.

(4) A coordinated care organization and its provider network shall use and disclose sensitive diagnosis information including HIV and other health and mental health diagnoses, within the coordinated care organization for the purpose of providing whole-person care. Individually identifiable health information must be treated as confidential and privileged information subject to ORS 192.553 (Policy for protected health information) to 192.581 (Allowed retention or disclosure of genetic information) and applicable federal privacy requirements. Redisclosure of individually identifiable information outside of the coordinated care organization and the organization’s providers for purposes unrelated to this section or the requirements of ORS 414.625 (Coordinated care organizations), 414.632 (Services to individuals who are dually eligible for Medicare and Medicaid), 414.635 (Consumer and provider protections), 414.638 (Metrics and scoring committee), 414.653 (Alternative payment methodologies) or 414.655 (Utilization of patient centered primary care homes and behavioral health homes by coordinated care organizations) remains subject to any applicable federal or state privacy requirements.

(5) This section does not prohibit the disclosure of information between a coordinated care organization and the organization’s provider network, and the Oregon Health Authority and the Department of Human Services for the purpose of administering the laws of Oregon.

(6) The Health Information Technology Oversight Council shall develop readily available informational materials that can be used by coordinated care organizations and providers to inform all participants in the health care workforce about the appropriate uses and limitations on disclosure of electronic health records, including need-based access and privacy mandates. [2011 c.602 §12]

Note: The amendments to 414.679 (Use and disclosure of member information) by section 11, chapter 389, Oregon Laws 2015, become operative February 1, 2017. See section 17, chapter 389, Oregon Laws 2015. The text that is operative on and after February 1, 2017, is set forth for the user’s convenience.

414.679 (Use and disclosure of member information). (1) The Oregon Health Authority shall ensure the appropriate use of member information by coordinated care organizations, including the use of electronic health information and administrative data that is available when and where the data is needed to improve health and health care through a secure, confidential health information exchange.

(2) A member of a coordinated care organization must have access to the member’s personal health information in the manner provided in 45 C.F.R. 164.524 so the member can share the information with others involved in the member’s care and make better health care and lifestyle choices.

(3) Notwithstanding ORS 179.505 (Disclosure of written accounts by health care services provider), a coordinated care organization, its provider network and programs administered by the Department of Human Services for seniors and persons with disabilities shall use and disclose member information for purposes of service and care delivery, coordination, service planning, transitional services and reimbursement, in order to improve the safety and quality of care, lower the cost of care and improve the health and well-being of the organization’s members.

(4) A coordinated care organization and its provider network shall use and disclose sensitive diagnosis information including HIV and other health and mental health diagnoses, within the coordinated care organization for the purpose of providing whole-person care. Individually identifiable health information must be treated as confidential and privileged information subject to ORS 192.553 (Policy for protected health information) to 192.581 (Allowed retention or disclosure of genetic information) and applicable federal privacy requirements. Redisclosure of individually identifiable information outside of the coordinated care organization and the organization’s providers for purposes unrelated to this section or the requirements of ORS 413.032 (Establishment of Oregon Health Authority), 414.625 (Coordinated care organizations), 414.632 (Services to individuals who are dually eligible for Medicare and Medicaid), 414.635 (Consumer and provider protections), 414.638 (Metrics and scoring committee), 414.653 (Alternative payment methodologies) or 414.655 (Utilization of patient centered primary care homes and behavioral health homes by coordinated care organizations) remains subject to any applicable federal or state privacy requirements.

(5) This section does not prohibit the disclosure of information between a coordinated care organization and the organization’s provider network, and the Oregon Health Authority and the Department of Human Services for the purpose of administering the laws of Oregon.

(6) The Health Information Technology Oversight Council shall develop readily available informational materials that can be used by coordinated care organizations and providers to inform all participants in the health care workforce about the appropriate uses and limitations on disclosure of electronic health records, including need-based access and privacy mandates.


1 Legislative Counsel Committee, CHAPTER 414—Medical Assistance, https://­www.­oregonlegislature.­gov/­bills_laws/­ors/­ors414.­html (2015) (last ac­cessed Jul. 16, 2016).
 
2 OregonLaws.org contains the con­tents of Volume 21 of the ORS, inserted along­side the per­tin­ent statutes. See the preface to the ORS An­no­ta­tions for more information.
 
3 OregonLaws.org assembles these lists by analyzing references between Sections. Each listed item refers back to the current Section in its own text. The result reveals relationships in the code that may not have otherwise been apparent.