Ask Reggi Your Question Now

Reggi is the free generative AI assistance for regulatory compliance
Ask a Question

Can I share personal information about my customers with third parties in Oregon? What are the requirements?

Sharing Personal Information with Third Parties in Oregon

In Oregon, personal information about clients can be shared with third parties in certain circumstances.

According to ORAR 411-005-0010, the Department must make information in a client case record or record of service available to the client or anyone authorized by the client, except as provided in section (2) of this rule and OAR 410-014-0030.

The Department may withhold from clients information that was obtained from a confidential informant if certain conditions are met. Additionally, an employee designated by the Department or local office must be present while the client or the authorized third party has access to the case record, and no one except a Department or local office employee is allowed to remove any material from the case record.

Disclosure of individually identifying information concerning clients without their authorization is allowed for purposes outlined in 410-014-0020 and for purposes directly connected with any investigation, prosecution, or criminal or civil proceeding conducted in connection with the administration of an assistance or service program, or the administration of any other federal or federally assisted program which provides assistance in cash, in-kind or services directly to individuals on the basis of need.

According to ORAR 411-005-0015, the Department may provide client information only to a law enforcement officer in certain situations, such as when the law enforcement officer is involved in carrying out public assistance laws, or any investigation, criminal or civil proceedings connected with administering the Department’s benefit programs. The disclosure may also be required or authorized by statute or administrative rule.

When sharing personal information with third parties in Oregon, it is important to follow the specific rules and regulations outlined in the relevant administrative rules, such as obtaining authorization from the client, ensuring that an employee designated by the Department or local office is present during access to the case record, and only sharing the minimum amount of information necessary for the purpose.

Additional Requirements for Sharing Personal Information with Third Parties in Oregon

In addition to the requirements outlined above, there may be additional requirements for sharing personal information with third parties in Oregon depending on the specific context.

For example, ORAR 839-030-0300 outlines the requirements for administering personal service contracts in Oregon. The Bureau of Labor and Industries may contract with consultants to provide required services, and all such contracts will be executed at a fair and reasonable price. The personal services contract rules (OAR chapter 125, division 20) of the Oregon Department of Administrative Services are adopted by reference as permanent rules for the Bureau of Labor and Industries, except to the extent modified in this or any other division of OAR chapter 839.

ORAR 582-030-0020 outlines the requirements for releasing information to other agencies, organizations, or authorities in Oregon. Form 2099 or other sufficient written authorization shall be used to obtain client permission to release or obtain client information. The cover page of any document, record, or report containing the Program’s client information released to any other agency, organization or person shall be imprinted with a statement that reads: CONFIDENTIAL This information cannot be released to any other person, agency, or organization without the prior written approval of the Oregon Vocational Rehabilitation Program. The Program may release confidential information to an organization, agency, or authority engaged in audit, evaluation, or research only for purposes directly connected with the administration of the vocational rehabilitation program, or for purposes which would significantly improve the quality of life for individuals with disabilities.

ORAR 173-015-0010 outlines the confidentiality requirements for individual account information, including, but not limited to, names, addresses, telephone numbers, personal identification information, amounts contributed and earnings on amounts contributed. This information shall be maintained as confidential, and may be disclosed only as needed to administer the network consistent with the Act, the Code and Oregon tax laws or unless the person providing the information or who is the subject of the information executes and delivers to the appropriate plan its written consent to disclosure.

ORAR 943-014-0020 outlines the uses and disclosures of client or participant protected information in Oregon. The Authority must obtain a completed and signed authorization for release of information from the individual, or the individual’s personal representative, before obtaining or using protected information about an individual from a third party or disclosing protected information about the individual to a third party. The Authority may use and disclose information without written authorization in certain circumstances, such as if the law requires or permits the disclosure, or for treatment, payment, and health care operations.

Therefore, when sharing personal information with third parties in Oregon, it is important to follow the specific rules and regulations outlined in the relevant administrative rules, as well as any additional requirements that may apply depending on the specific context.

[2.1][3.1][4.1][6.1]

Source(s):
Jurisdiction

Oregon