A health care provider or state health plan:

(1) May use or disclose protected health information of an individual in a manner that is consistent with an authorization provided by the individual or a personal representative of the individual.

(2) May use or disclose protected health information of an individual without obtaining an authorization from the individual or a personal representative of the individual:

(a) For the provider’s or plan’s own treatment, payment or health care operations; or

(b) As otherwise permitted or required by state or federal law or by order of the court.

(3) May disclose protected health information of an individual without obtaining an authorization from the individual or a personal representative of the individual:

(a) To another covered entity for health care operations activities of the entity that receives the information if:

(A) Each entity has or had a relationship with the individual who is the subject of the protected health information; and

(B) The protected health information pertains to the relationship and the disclosure is for the purpose of:

(i) Health care operations as listed in ORS § 192.556 (4)(a) or (b); or

(ii) Health care fraud and abuse detection or compliance;

(b) To another covered entity or any other health care provider for treatment activities of a health care provider;

(c) To another covered entity or any other health care provider for the payment activities of the entity that receives that information; or

(d) In accordance with ORS § 192.567 or 192.577. [Formerly 192.520; 2015 c.473 § 5; 2017 c.484 § 4]

See note under 192.553.

[1991 c.825 § 2; 1993 c.274 § 2; 2001 c.962 § 82; renumbered 192.591 in 2011]

[1977 c.517 § 3; renumbered 192.593 in 2011]