Oregon - HIPAA Changes to Oregon Law
The summary below was prepared by Barney Mc Dowell for 10/3/2003 AMHA-OR meeting. Updates will be posted.
Oregon Laws Relating To HIPAA--Update October 3, 2003
I. On May 24, 2003 four Oregon Laws conformed Oregon statues to HIPAA to some degree.
A. House Bills 2305, 2306, and 2307 “create” new provisions, “amend” or “repeal” more than 100 other Oregon Revised Statutes.
B. Find and download these laws at: www.leg.state.or.us/03reg/measures/main.html
C. This outline 1) alerts therapists that these laws exist and 2) offers orientation to their content. There is no claim here to represent them accurately or their implications; and that’s less a formal disclaimer than a statement about their complexity and the lack of clarity with which they are encoded into the law. At several points they simply refer to dozens of statutes being amended but there is no up to date amended version available; you can find and research the old versions of the Oregon Revised Statutes at: www.leg.state.or.us/ors/orschs-4.html
II. HB 2305 :: How “health information” of “an individual” must be treated
A. 2305 mirrors some definitions and requirements of HIPAA:
1. Rights—virtually the same as HIPAA
2. Authorizations—gives a sample form; under 2305, you “may” release info with an authorization but the new law removed the section allowing the possibility of substituting a summary when the whole record is asked for.
3. Defines terms: “covered entity”, “state health plan”, “payment”, etc.
Specifies conditions to “use and disclose”…“protected health information”.
4. Makes changes regarding immunizations, long term care, OHSU, etc..
III. HB 2306 :: Primarily aimed at Insurers
A. Sets requirements for insurers conformed to HIPAA; empowers the Director of the Department of Consumer and Business Services to set rules within certain guidelines for insurers to meet these new requirements.
B. Among permitted uses and disclosures, a “health insurer” may obtain information from “another covered entity” for the “purpose of”…“health care fraud and abuse
detection or compliance”.
C. This law gives definitions similar to 2305 and HIPAA such as “covered entity”, “health care provider”, and “protected health information”.
IV. HB 2307 :: “Relating to health information” and State Institutions
A. Makes amendments regarding ORS 179 Administration of State Institutions; specifically amends rules re: Department of Corrections
B. Section 2 amends “179.505 Inspection, disclosure or release of patient records by provider; consent; exceptions; scope of use; release to others.” It sets definitions primarily aimed at public institutions; but “Health care services provider” may include you if you have a “program or service providing treatment by appointment that is licensed, approved, established, maintained or operated by or contracted with the Department of Human Services for alcoholism, drug addiction or mental or emotional distrubance”. Sec 2 (g) (H); it sets the definition of “psychotherapy notes” consistent with HIPAA.
C. Under 2307: “If the individual… provides an authorization, the content of any written account…must be disclosed …”; note that 2305 says “may” not “must”.
© 1998-2010 American Mental Health Alliance.
