Can I collect personal information from participants in Oregon? What are the requirements?

To collect personal information from participants in Oregon, there are several requirements that must be met. These requirements include obtaining client permission, redacting certain personal information, and limiting disclosure of information in certain circumstances.

Obtaining Client Permission

According to ORAR 582-030-0020, before releasing or obtaining client information, a Form 2099 or other sufficient written authorization must be used to obtain client permission. The form must be completed to indicate informed consent, involved parties, and timelines for obtaining or releasing specified information. The cover page of any document, record, or report containing the Program’s client information released to any other agency, organization, or person shall be imprinted with a statement that reads: CONFIDENTIAL This information cannot be released to any other person, agency, or organization without the prior written approval of the Oregon Vocational Rehabilitation Program.

Redacting Certain Personal Information

According to ORRS 192.377, a public body that is the custodian of or is otherwise in possession of information that was submitted to the public body in confidence and is not otherwise required by law to be submitted, must redact all of the following information before making a disclosure described in ORS 192.355 (4): (1) Residential address and telephone numbers; (2) Personal electronic mail addresses and personal cellular telephone numbers; (3) Social Security numbers and employer-issued identification card numbers; and (4) Emergency contact information.

Limiting Disclosure of Information

According to ORAR 411-005-0035, client specific information must not be divulged in any judicial proceeding unless: (a) The proceeding is directly connected with administration of public assistance or service under chapter 411 of the Oregon Administrative Rules; or (b) The client has given written authorization for release of specific information at the judicial proceeding; or (c) A judge orders the release of the information. Except in the presence of one of these three conditions, no information will be released in any form during any stage of a judicial proceeding either voluntarily or as the result of a subpoena.

According to ORAR 411-005-0015, the Department may provide client information only to a law enforcement officer in any of the following situations: (a) The law enforcement officer is involved in carrying out public assistance laws, or any investigation, criminal or civil proceedings connected with administering the Department’s benefit programs. (b) The disclosure is required or authorized by statute or administrative rule. The Department may give a client’s current address, Social Security number, and photo to a law enforcement officer if the law enforcement officer makes the request in the course of official duty, supplies the client’s name, and states that the client: (a) Is a fugitive felon or is violating parole or probation; or (b) Has information that is necessary for the officer to conduct official duties of the officer, and the location or apprehension of the client is within the officer’s official duties.

Conclusion

To collect personal information from participants in Oregon, you must obtain client permission, redact certain personal information, and limit disclosure of information in certain circumstances. These requirements are outlined in the relevant rules and statutes, including ORAR 582-030-0020, ORRS 192.377, ORAR 411-005-0035, and ORAR 411-005-0015.

Jurisdiction

Oregon

• Privacy