Ask Reggi Your Question Now

Reggi is the free generative AI assistance for regulatory compliance
Ask a Question

Can I use third-party collaboration tools that collect personal information in Oregon? What are the requirements?

Requirements for Using Third-Party Collaboration Tools that Collect Personal Information in Oregon

If you are using third-party collaboration tools that collect personal information in Oregon, you must comply with the state’s laws and regulations regarding the disclosure of information to clients or third parties.

According to ORAR 411-005-0010, the Department must make information in a client case record or record of service available to the client or anyone authorized by the client, except for information obtained from a confidential informant that meets certain criteria. The Department may also exchange client information with other governmental or private, non-profit agencies if necessary to assist the individual in accessing other governmental or private, non-profit services that will benefit or serve the individual.

ORAR 943-014-0020 outlines the uses and disclosures of client or participant protected information. The Authority must obtain a completed and signed authorization for release of information from the individual, or the individual’s personal representative, before obtaining or using protected information about an individual from a third party or disclosing protected information about the individual to a third party. The Authority may use and disclose information without written authorization in certain circumstances, such as for treatment, payment, and health care operations, public health activities, and research purposes.

ORAR 471-012-0020 states that Interagency Shared Information System data shall only be disclosed in the aggregate consisting of no fewer than six unit records. All disclosures must comply with applicable federal and state law, including any written agreement between the participants and the system administrator. Participants may view the individual records input by the participant for their own customers, even if fewer than six unit records, provided that such viewing complies with applicable federal and state law.

Therefore, if you are using third-party collaboration tools that collect personal information in Oregon, you must obtain authorization from the individual or their personal representative before disclosing their protected information to the third party. Additionally, you must ensure that the disclosure complies with the relevant laws and regulations and is limited to the minimum necessary information.

It is important to note that the above information is not an exhaustive list of all the requirements for using third-party collaboration tools that collect personal information in Oregon. You should consult with a legal professional to ensure that you are fully compliant with all applicable laws and regulations.

[1.1][3.1][4.1]

Source(s):
Jurisdiction

Oregon