As used in ORS § 192.553 to 192.581:

(1) ‘Authorization’ means a document written in plain language that contains at least the following:

(a) A description of the information to be used or disclosed that identifies the information in a specific and meaningful way;

(b) The name or other specific identification of the person or persons authorized to make the requested use or disclosure;

(c) The name or other specific identification of the person or persons to whom the covered entity may make the requested use or disclosure;

(d) A description of each purpose of the requested use or disclosure, including but not limited to a statement that the use or disclosure is at the request of the individual;

(e) An expiration date or an expiration event that relates to the individual or the purpose of the use or disclosure;

(f) The signature of the individual or personal representative of the individual and the date;

(g) A description of the authority of the personal representative, if applicable; and

(h) Statements adequate to place the individual on notice of the following:

(A) The individual’s right to revoke the authorization in writing;

(B) The exceptions to the right to revoke the authorization;

(C) The ability or inability to condition treatment, payment, enrollment or eligibility for benefits on whether the individual signs the authorization; and

(D) The potential for information disclosed pursuant to the authorization to be subject to redisclosure by the recipient and no longer protected.

(2) ‘Covered entity’ means:

(a) A state health plan;

(b) A health insurer;

(c) A health care provider that transmits any health information in electronic form to carry out financial or administrative activities in connection with a transaction covered by ORS § 192.553 to 192.581; or

(d) A health care clearinghouse.

(3) ‘Health care’ means care, services or supplies related to the health of an individual.

(4) ‘Health care operations’ includes but is not limited to:

(a) Quality assessment, accreditation, auditing and improvement activities;

(b) Case management and care coordination;

(c) Reviewing the competence, qualifications or performance of health care providers or health insurers;

(d) Underwriting activities;

(e) Arranging for legal services;

(f) Business planning;

(g) Customer services;

(h) Resolving internal grievances;

(i) Creating deidentified information; and

(j) Fundraising.

(5) ‘Health care provider’ includes but is not limited to:

(a) A psychologist, occupational therapist, regulated social worker, professional counselor or marriage and family therapist licensed or otherwise authorized to practice under ORS Chapter 675 or an employee of the psychologist, occupational therapist, regulated social worker, professional counselor or marriage and family therapist;

(b) A physician or physician assistant licensed under ORS Chapter 677, an acupuncturist licensed under ORS § 677.759 or an employee of the physician, physician assistant or acupuncturist;

(c) A nurse or nursing home administrator licensed under ORS Chapter 678 or an employee of the nurse or nursing home administrator;

(d) A dentist licensed under ORS Chapter 679 or an employee of the dentist;

(e) A dental hygienist or denturist licensed under ORS Chapter 680 or an employee of the dental hygienist or denturist;

(f) A speech-language pathologist or audiologist licensed under ORS Chapter 681 or an employee of the speech-language pathologist or audiologist;

(g) An emergency medical services provider licensed under ORS Chapter 682;

(h) An optometrist licensed under ORS Chapter 683 or an employee of the optometrist;

(i) A chiropractic physician licensed under ORS Chapter 684 or an employee of the chiropractic physician;

(j) A naturopathic physician licensed under ORS Chapter 685 or an employee of the naturopathic physician;

(k) A massage therapist licensed under ORS § 687.011 to 687.250 or an employee of the massage therapist;

(L) A direct entry midwife licensed under ORS § 687.405 to 687.495 or an employee of the direct entry midwife;

(m) A physical therapist licensed under ORS § 688.010 to 688.201 or an employee of the physical therapist;

(n) A medical imaging licensee under ORS § 688.405 to 688.605 or an employee of the medical imaging licensee;

(o) A respiratory care practitioner licensed under ORS § 688.815 or an employee of the respiratory care practitioner;

(p) A polysomnographic technologist licensed under ORS § 688.819 or an employee of the polysomnographic technologist;

(q) A pharmacist licensed under ORS Chapter 689 or an employee of the pharmacist;

(r) A dietitian licensed under ORS § 691.405 to 691.485 or an employee of the dietitian;

(s) A funeral service practitioner licensed under ORS Chapter 692 or an employee of the funeral service practitioner;

(t) A health care facility as defined in ORS § 442.015;

(u) A home health agency as defined in ORS § 443.014;

(v) A hospice program as defined in ORS § 443.850;

(w) A clinical laboratory as defined in ORS § 438.010;

(x) A pharmacy as defined in ORS § 689.005; and

(y) Any other person or entity that furnishes, bills for or is paid for health care in the normal course of business.

(6) ‘Health information’ means any oral or written information in any form or medium that:

(a) Is created or received by a covered entity, a public health authority, an employer, a life insurer, a school, a university or a health care provider that is not a covered entity; and

(b) Relates to:

(A) The past, present or future physical or mental health or condition of an individual;

(B) The provision of health care to an individual; or

(C) The past, present or future payment for the provision of health care to an individual.

(7) ‘Health insurer’ means an insurer as defined in ORS § 731.106 who offers:

(a) A health benefit plan as defined in ORS § 743B.005;

(b) A short term health insurance policy, the duration of which does not exceed three months including renewals;

(c) A student health insurance policy;

(d) A Medicare supplemental policy; or

(e) A dental only policy.

(8) ‘Individually identifiable health information’ means any oral or written health information in any form or medium that is:

(a) Created or received by a covered entity, an employer or a health care provider that is not a covered entity; and

(b) Identifiable to an individual, including demographic information that identifies the individual, or for which there is a reasonable basis to believe the information can be used to identify an individual, and that relates to:

(A) The past, present or future physical or mental health or condition of an individual;

(B) The provision of health care to an individual; or

(C) The past, present or future payment for the provision of health care to an individual.

(9) ‘Payment’ includes but is not limited to:

(a) Efforts to obtain premiums or reimbursement;

(b) Determining eligibility or coverage;

(c) Billing activities;

(d) Claims management;

(e) Reviewing health care to determine medical necessity;

(f) Utilization review; and

(g) Disclosures to consumer reporting agencies.

(10) ‘Personal representative’ includes but is not limited to:

(a) A person appointed as a guardian under ORS § 125.305, 419B.372, 419C.481 or 419C.555 with authority to make medical and health care decisions;

(b) A person appointed as a health care representative under ORS § 127.505 to 127.660 or a representative under ORS § 127.700 to 127.737 to make health care decisions or mental health treatment decisions;

(c) A person appointed as a personal representative under ORS Chapter 113; and

(d) A person described in ORS § 192.573.

(11)(a) ‘Protected health information’ means individually identifiable health information that is maintained or transmitted in any form of electronic or other medium by a covered entity.

(b) ‘Protected health information’ does not mean individually identifiable health information in:

(A) Education records covered by the federal Family Educational Rights and Privacy Act (20 U.S.C. § 1232g);

(B) Records described at 20 U.S.C. § 1232g(a)(4)(B)(iv); or

(C) Employment records held by a covered entity in its role as employer.

(12) ‘State health plan’ means:

(a) Medical assistance as defined in ORS § 414.025;

(b) The Cover All People program; or

(c) Any medical assistance or premium assistance program operated by the Oregon Health Authority.

(13) ‘Treatment’ includes but is not limited to:

(a) The provision, coordination or management of health care; and

(b) Consultations and referrals between health care providers. [Formerly 192.519; 2013 c.129 § 24; 2013 c.681 § 42; 2013 c.698 § 30; 2017 c.152 1,2; 2017 c.206 12,13; 2021 c.554 § 3]

See note under 192.553.

[1987 c.438 § 2; 1999 c.80 § 69; 2003 c.73 § 59; renumbered 192.588 in 2011]