2015 ORS 743.005¹
Protection of health information report

(1) As used in this section:

(a) "Covered entity" has the meaning given that term in ORS 192.556 (Definitions for ORS 192.553 to 192.581) but excludes state agencies.

(b) "Protected health information" has the meaning given that term in ORS 192.556 (Definitions for ORS 192.553 to 192.581).

(2) A covered entity that is required to file an annual financial statement under ORS 731.574 (Annual financial statement) shall file with the Department of Consumer and Business Services, along with the financial statement, a protection of health information report. The report may be in the form of a letter, must be signed by the chief executive officer of the covered entity and must:

(a) State the responsibility of the covered entity’s management to establish and maintain adequate safeguards and procedures for protecting the confidentiality of personally identifiable and protected health information that the covered entity retains in electronic and hard copy form;

(b) Contain assurances that the signing officer has disclosed to the governing board of the covered entity:

(A) All significant deficiencies in the design or operation of recordkeeping systems or controls that could adversely affect the covered entity’s ability to protect the confidentiality of personally identifiable and protected health information;

(B) Any breaches of the security of personally identifiable and protected health information, whether material or not, that involve management or other employees who have a significant role in the covered entity’s recordkeeping systems or controls; and

(C) All necessary steps that have been taken to address deficiencies in the design or operation of recordkeeping systems or controls and to resolve any material weaknesses identified to or by the covered entity’s auditors; and

(c) Contain assurances that the signing officer has identified for the governing board of the covered entity any material weaknesses in the recordkeeping systems or controls.

(3) The protection of health information report is confidential and not subject to disclosure under ORS 192.410 (Definitions for ORS 192.410 to 192.505) to 192.505 (Exempt and nonexempt public record to be separated). [2015 c.133 §2]

Note: 743.005 (Protection of health information report) was added to and made a part of the Insurance Code by legislative action but was not added to ORS chapter 743 or any series therein. See Preface to Oregon Revised Statutes for further explanation.


1 Legislative Counsel Committee, CHAPTER 743—Health and Life Insurance, https://­www.­oregonlegislature.­gov/­bills_laws/­ors/­ors743.­html (2015) (last ac­cessed Jul. 16, 2016).
 
2 OregonLaws.org contains the con­tents of Volume 21 of the ORS, inserted along­side the per­tin­ent statutes. See the preface to the ORS An­no­ta­tions for more information.
 
3 OregonLaws.org assembles these lists by analyzing references between Sections. Each listed item refers back to the current Section in its own text. The result reveals relationships in the code that may not have otherwise been apparent.