Can I skip obtaining consent to disclose personal information for a business purpose in Oregon? What are the requirements?

To answer your question, in most cases, obtaining consent to disclose personal information for a business purpose is required in Oregon. However, there are some exceptions to this requirement.

Exceptions to Written Consent Requirements

Under ORS 124.060, abuse of individuals age 65 and over must be reported to the appropriate authorities. Similarly, under ORS 419B.010, abuse of individuals under the age of 18 must be reported to the appropriate authorities. Under ORS 430.765, abuse of individuals 18 years of age or over with developmental disabilities or mental illness must be reported to the appropriate authorities. Under ORS 441.640, abuse of residents of long-term care facilities must be reported to the appropriate authorities. In these cases, written consent is not required to disclose personal information.

Additionally, under ORS 25.265, an individual authorized under federal law may access information for the Federal Parent Locator Service without obtaining written consent.

Business Associate Contracts

Under ORAR 943-014-0420, a contractor who is a business associate of the Authority may use or disclose protected health information and electronic protected health information to perform functions, activities, or services as specified in the contract and these rules on behalf of the Authority. However, all other use or disclosure of protected health information and electronic protected health information is prohibited unless authorized by the Authority.

In summary, while obtaining consent to disclose personal information for a business purpose is generally required in Oregon, there are some exceptions to this requirement. Additionally, business associate contracts may allow for the use or disclosure of protected health information without obtaining written consent.

Jurisdiction

Oregon

• Privacy