2015 ORS 431A.865¹
Disclosure of information
  • corrections
  • records
  • immunity from liability

Caution-flag-2-25x25
This section is amended
Effective April 4, 2016
Relating to prescription drugs; creating new provisions; amending ORS 431A.865 and 689.681; and declaring an emergency.

(1)(a) Except as provided under subsection (2) of this section, prescription monitoring information submitted under ORS 431A.860 (Duty of pharmacy to report to program) to the prescription monitoring program established in ORS 431A.855 (Establishment of program):

(A) Is protected health information under ORS 192.553 (Policy for protected health information) to 192.581 (Allowed retention or disclosure of genetic information).

(B) Is not subject to disclosure pursuant to ORS 192.410 (Definitions for ORS 192.410 to 192.505) to 192.505 (Exempt and nonexempt public record to be separated).

(b) Except as provided under subsection (2)(a)(E) of this section, prescription monitoring information submitted under ORS 431A.860 (Duty of pharmacy to report to program) to the prescription monitoring program may not be used to evaluate a practitioner’s professional practice.

(2)(a) To the extent that the law or regulation is applicable to the prescription monitoring program, if a disclosure of prescription monitoring information, other than the sex of a patient for whom a drug was prescribed, complies with the federal Health Insurance Portability and Accountability Act of 1996 (P.L. 104-191) and regulations adopted under it, including 45 C.F.R. parts 160 and 164, federal alcohol and drug treatment confidentiality laws and regulations adopted under those laws, including 42 C.F.R. part 2, and state health and mental health confidentiality laws, including ORS 179.505 (Disclosure of written accounts by health care services provider), 192.517 (Access to records of individual with disability or individual with mental illness) and 192.553 (Policy for protected health information) to 192.581 (Allowed retention or disclosure of genetic information), the Oregon Health Authority shall disclose the information:

(A) To a practitioner or pharmacist, or, if a practitioner or pharmacist authorizes the authority to disclose the information to a member of the practitioner’s or pharmacist’s staff, to a member of the practitioner’s or pharmacist’s staff. If a practitioner or pharmacist authorizes disclosing the information to a member of the practitioner’s or pharmacist’s staff under this subparagraph, the practitioner or pharmacist remains responsible for the use or misuse of the information by the staff member. To receive information under this subparagraph, or to authorize the receipt of information by a staff member under this subparagraph, a practitioner or pharmacist must certify that the requested information is for the purpose of evaluating the need for or providing medical or pharmaceutical treatment for a patient to whom the practitioner or pharmacist anticipates providing, is providing or has provided care.

(B) To a practitioner in a form that catalogs all prescription drugs prescribed by the practitioner according to the number assigned to the practitioner by the Drug Enforcement Administration of the United States Department of Justice.

(C) To designated representatives of the authority or any vendor or contractor with whom the authority has contracted to establish or maintain the electronic system of the prescription monitoring program.

(D) Pursuant to a valid court order based on probable cause and issued at the request of a federal, state or local law enforcement agency engaged in an authorized drug-related investigation involving a person to whom the requested information pertains.

(E) To a health professional regulatory board that certifies in writing that the requested information is necessary for an investigation related to licensure, renewal or disciplinary action involving the applicant, licensee or registrant to whom the requested information pertains.

(F) To a prescription monitoring program of another state if the confidentiality, security and privacy standards of the requesting state are determined by the authority to be equivalent to those of the authority.

(G) To the State Medical Examiner or designee of the State Medical Examiner, for the purpose of conducting a medicolegal investigation or autopsy.

(b) The authority may disclose information from the prescription monitoring program that does not identify a patient, practitioner or drug outlet:

(A) For educational, research or public health purposes;

(B) To a local public health authority, as defined in ORS 431.003 (Definitions); or

(C) To officials of the authority who are conducting special epidemiologic morbidity and mortality studies in accordance with ORS 413.196 (Confidentiality and inadmissibility of information obtained in connection with epidemiologic morbidity and mortality studies) and rules adopted under ORS 431.001 (Findings) to 431.550 (Power of Oregon Health Authority to collect information from local public health administrators) and 431.990 (Penalties).

(c) The Oregon Health Authority shall disclose information relating to a patient maintained in the electronic system operated pursuant to the prescription monitoring program established under ORS 431A.855 (Establishment of program) to that patient at no cost to the patient within 10 business days after the authority receives a request from the patient for the information.

(d)(A) A patient may request the authority to correct any information about the patient that is erroneous. The authority shall grant or deny a request to correct information within 10 business days after the authority receives the request.

(B) If the authority denies a patient’s request to correct information under this paragraph, or fails to grant a patient’s request to correct information under this paragraph within 10 business days after the authority receives the request, the patient may appeal the denial or failure to grant the request. Upon receipt of an appeal under this subparagraph, the authority shall conduct a contested case hearing as provided in ORS chapter 183. Notwithstanding ORS 183.450 (Evidence in contested cases), in the contested case hearing, the authority has the burden of establishing that the information included in the prescription monitoring program is correct.

(e) The information in the prescription monitoring program may not be used for any commercial purpose.

(f) In accordance with ORS 192.553 (Policy for protected health information) to 192.581 (Allowed retention or disclosure of genetic information) and federal privacy regulations, any person authorized to prescribe or dispense a prescription drug and who is entitled to access a patient’s prescription monitoring information may discuss or release the information to other health care providers involved with the patient’s care, in order to provide safe and appropriate care coordination.

(3)(a) The authority shall maintain records of the information disclosed through the prescription monitoring program including, but not limited to:

(A) The identity of each person who requests or receives information from the program and the organization, if any, the person represents;

(B) The information released to each person or organization; and

(C) The date and time the information was requested and the date and time the information was provided.

(b) Records maintained as required by this subsection may be reviewed by the Prescription Monitoring Program Advisory Commission.

(4) Information in the prescription monitoring program that identifies an individual patient must be removed no later than three years from the date the information is entered into the program.

(5) The authority shall notify the Attorney General and each affected individual of an improper disclosure of information from the prescription monitoring program.

(6)(a) If the authority or a person or entity required to report or authorized to receive or release controlled substance prescription information under this section violates this section or ORS 431A.860 (Duty of pharmacy to report to program) or 431A.870 (Duty of pharmacist to fill prescription), a person injured by the violation may bring a civil action against the authority, person or entity and may recover damages in the amount of $1,000 or actual damages, whichever is greater.

(b) Notwithstanding paragraph (a) of this subsection, the authority and a person or entity required to report or authorized to receive or release controlled substance prescription information under this section are immune from civil liability for violations of this section or ORS 431A.860 (Duty of pharmacy to report to program) or 431A.870 (Duty of pharmacist to fill prescription) unless the authority, person or entity acts with malice, criminal intent, gross negligence, recklessness or willful intent.

(7) Nothing in ORS 431A.855 (Establishment of program) to 431A.900 (Civil penalty for violation of ORS 431A.855 to 431A.900) requires a practitioner or pharmacist who prescribes or dispenses a prescription drug to obtain information about a patient from the prescription monitoring program. A practitioner or pharmacist who prescribes or dispenses a prescription drug may not be held liable for damages in any civil action on the basis that the practitioner or pharmacist did or did not request or obtain information from the prescription monitoring program. [Formerly 431.966]


1 Legislative Counsel Committee, CHAPTER 431A—Public Health Programs and Activities, https://­www.­oregonlegislature.­gov/­bills_laws/­ors/­ors431A.­html (2015) (last ac­cessed Jul. 16, 2016).
 
2 OregonLaws.org contains the con­tents of Volume 21 of the ORS, inserted along­side the per­tin­ent statutes. See the preface to the ORS An­no­ta­tions for more information.
 
3 OregonLaws.org assembles these lists by analyzing references between Sections. Each listed item refers back to the current Section in its own text. The result reveals relationships in the code that may not have otherwise been apparent.