Loading

Oregon Bulletin

October 1, 2011

 

Oregon Health Authority
Chapter 943

Rule Caption: Authority Employees, Volunteers and Contractors Background Checks and Contesting Fitness Determinations

Adm. Order No.: OHA 17-2011(Temp)

Filed with Sec. of State: 8-30-2011

Certified to be Effective: 9-1-11 thru 12-27-11

Notice Publication Date:

Rules Amended: 943-007-0000

Rules Suspended: 943-007-0000(T)

Subject: HB 2009 (2009) created the Oregon Health Authority and transferred to the Authority the Department of Human Services’ (Department) Divisions with respect to health and health care. Effective July 1, 2011 the Authority adopted and incorporate by reference the Department’s rules chapter 407-007-000 to 0075; 407-007-0090 to 0100; 407-0200 to 0325; and 407-007-0340 to 0370 for matters that involve employees, volunteers, providers or contractors of the Authority are subject to background checks before the individual may work, volunteer be employed, hold the position, or provide services.

      HB 2100(2011) was signed by the Governor on August 5, 2011, with an emergency clause. HB 2100 allows the Authority to use reports of abuse or neglect when conducting background checks on individuals who are employed, seek employment, volunteer, or seek to be a volunteer, provide care, or seek to be a care provider on behalf of the Authority for clients of the Authority.

      This rule is being amended to adopt and incorporate by reference the Department of Human Services’ Background Check Unit rules chapter 407-007-0400 to 0460 for matters that involve abuse and neglect checks for employees, volunteers, providers or contractors of the Authority who are subject to background checks before the individual may work, volunteer be employed, hold the position, or provide services.

      The Authority needs to amend OAR 943-007-0000 which allows the Authority to use reports of abuse and neglect when conducting background checks on subject individuals.

Rules Coordinator: Evonne Alderete—(503) 932-9663

943-007-0000

Criminal History Checks

Employees, volunteers, providers and contractors for the Oregon Health Authority (Authority) are subject to background checks and screening to determine if they have a history of criminal behavior such that they should not be allowed to work, volunteer, be employed, or otherwise perform in positions covered by these rules.

(1) The Authority adopts and incorporates by reference the rules established in: OAR 407-007-0000 to 0075 and 407-007-0090 to 0100 (Employees, Volunteers and Contractors); for those matters that involve employees, volunteers, or contractors of the Authority, except as otherwise provided in this rule.

(2) The Authority adopts and incorporates by reference the rules established in: OAR 407-007-0200 to 0325; and 407-007-0335 to 0370 (Providers) for those matters that involve any entity or agency licensed, certified, registered, or otherwise regulated by the Authority, except as otherwise provided in this rule.

(3) The Authority adopts and incorporates by reference the rules established in OAR 407-007-0400 to 0460 for those matters that involve abuse checks for Authority employees, volunteers, and applicants for employment or volunteer positions, except as otherwise provided in this rule.

(4) Any reference to any rule from OAR 407-007-0000 to 407-007-0100 in rules or contracts of the Authority are deemed to be references to the requirements of this rule, and shall be construed to apply to employees, volunteers, providers, or contractors of the Authority.

(5) References in OAR 407-007-0000 to 407-007-00400 to the Department of Human Services (Department) or to the Oregon Health Authority shall be construed to be references to either or both agencies.

(6) The Authority authorizes the Department to act on its behalf in carrying out background checks and screening associated with the administration of programs or activities administered by the Authority.

(7) Appeals shall be conducted by the Authority pursuant to OAR 943-007-0500.

Stat. Auth.: ORS 181.534, 181.537, 413.042

Stats. Implemented: ORS 181.534, 181.537, 183.341

Hist.: OHA 6-2011(Temp), f. & cert. ef. 7-1-11 thru 12-27-11; OHA 17-2011(Temp), f. 8-30-11, cert. ef. 9-1-11 thru 12-27-11

 

Rule Caption: Establishment of process for restricting an individual’s access to Authority premises, employees, and visitors

Adm. Order No.: OHA 18-2011

Filed with Sec. of State: 8-30-2011

Certified to be Effective: 9-1-11

Notice Publication Date: 8-1-2011

Rules Adopted: 943-012-0005, 943-012-0010, 943-012-0015, 943-012-0020, 943-012-0025

Subject: Allows the Authority to protect Authority employees, visitors, and its premises from threats or acts of violence. Defines prohibited conduct and establishes criteria for restricting an individual’s access to Authority employees, visitors, and its premises when an individual has engaged in prohibited conduct.

Rules Coordinator: Evonne Alderete—(503) 932-9663

943-012-0005

Definitions

The following definitions apply to OAR 943-012-0005 through 943-012-0025:

(1) “Authority” means the Oregon Health Authority.

(2) “Division” means every individual organizational unit within the Authority.

(3) “Employee” means individuals acting in the course and scope of their duties who are on the State of Oregon payroll, contract employees, employees of temporary service agencies, and volunteers. It also includes employees of other government or social service agencies who, at the time they are accompanying an Authority employee on Authority business, are the target of conduct described in OAR 943-012-0010.

(4) “Premises” means any land, building, facility, and other property owned, leased, or in the possession of, and used or controlled by the Authority. When the Authority occupies space in a building occupied by multiple tenants, the definition includes the common areas of the building used by all tenants such as, but not limited to, restrooms, hallways, and food service areas.

(5) “Restriction of Access” means the Authority has limited an individual’s access to specific Authority premises, employees, or methods of communication.

(6) “Weapon” includes, but is not limited to:

(a) A dangerous or deadly weapon as defined in ORS 161.015;

(b) Any other object or substance used in a manner that compromises the safety of Authority employees or visitors on Authority premises;

(c) An imitation or replica of any of the above.

Stat. Auth.: ORS 413.042

Stats. Implemented: ORS 413.042, 654.010

Hist.: OHA 7-2011(Temp), f. & cert. ef. 7-1-11 thru 12-27-11; OHA 18-2011, f. 8-30-11, cert. ef. 9-1-11

943-012-0010

Prohibited Conduct

(1) Conduct that may result in restriction of access includes, but is not limited to the following:

(a) Causing or threatening to cause physical injury to Authority employees or visitors;

(b) Engaging in actions which compromise the safety or health of Authority employees or visitors;

(c) Causing or threatening to cause harm to the family or property of an employee or visitors through written, electronic, or verbal communication;

(d) Causing or threatening to cause damage to Authority premises;

(e) Bringing a deadly or dangerous weapon onto the Authority’s premises, unless authorized by ORS chapter 166 to carry a handgun;

(f) Displaying, attempting, or threatening to use any weapon, on or off Authority premises, that compromises the safety of Authority employees or visitors;

(g) Engaging in harassing conduct as defined in ORS 166.065.

(h) Engaging in telephonic harassment as defined in ORS 166.090.

(2) The conduct listed in section (1) is also prohibited if it occurs during employees’ off-work hours and off Authority premises and the prohibited conduct is related to the employee’s work with the Authority.

(3) Prior to issuing a restriction of access notice, the Authority shall make an individualized assessment as to whether the conduct listed in section (1) of this rule is a result of a disability of which the Authority has knowledge and whether the conduct is a “direct threat” to others as described in OAR 943-005-0000 through 943-005-0030. If the Authority determines the disabled individual’s conduct is not a direct threat, the Authority shall explore the possibility of a reasonable accommodation to mitigate the safety risk.

(4) The prohibitions on conduct in this rule do not apply to individuals who are residents of an Authority-operated residential facility.

Stat. Auth.: ORS 413.042

Stats. Implemented: ORS 413.042, 654.010

Hist.: OHA 7-2011(Temp), f. & cert. ef. 7-1-11 thru 12-27-11; OHA 18-2011, f. 8-30-11, cert. ef. 9-1-11

943-012-0015

Continuation of Eligible Services

(1) An individual whose access has been restricted by the Authority shall continue to be provided services for which the individual meets program eligibility requirements by an alternate and effective method of communication as determined by the Authority.

(2) Alternate methods may include telephone, electronic mail, written communication, meeting at a designated secure site, or through the individual’s representative.

Stat. Auth.: ORS 413.042

Stats. Implemented: ORS 413.042, 654.010

Hist.: OHA 7-2011(Temp), f. & cert. ef. 7-1-11 thru 12-27-11; OHA 18-2011, f. 8-30-11, cert. ef. 9-1-11

943-012-0020

Notification

(1) If the Authority determines that it is necessary to restrict access or the methods of communication because of prohibited conduct, the individual will be provided written notification, signed by the assistant director or deputy assistant director of the affected division, and sent by certified mail or other traceable means. The notice shall describe the following:

(a) Conduct giving rise to the restrictions;

(b) The specific premises or parts of premises from which the individual is excluded; or the forms of communication which are restricted;

(c) The alternate method by which services may be obtained;

(d) Contact information for services or appointment scheduling;

(e) The availability of the review process, including notification that individuals with disabilities are entitled to request modification;

(f) The potential criminal consequences for violating the notice of restriction of access; and

(g) The law enforcement agency being notified.

(2) The notice shall be effective upon issuance.

(3) Restrictions on access to Authority premises or methods of communication shall remain in place until the Authority determines the individual no longer poses a threat and issues an official notification of removal.

Stat. Auth.: ORS 413.042

Stats. Implemented: ORS 413.042, 654.010

Hist.: OHA 7-2011(Temp), f. & cert. ef. 7-1-11 thru 12-27-11; OHA 18-2011, f. 8-30-11, cert. ef. 9-1-11

943-012-0025

Authority Review

(1) The Authority shall establish an internal review process to ensure that a notice of restriction of access is warranted prior to issuing a written notice of restriction of access.

(2) Following the Authority’s issuance of a notice of restriction of access, the recipient of the notice may request review of the Authority’s determination. The request must be submitted to the office of the Director of the Authority. The request must be in writing and submitted, by mail or personal delivery, within 15 business days of the date of issuance of the notice of restriction of access. If the request is submitted by mail, it must be postmarked within 15 business days. No particular format is required for the request for review; however, the individual should include specific grounds for requesting the review.

(3) Upon receipt of a request for review, the Director or an assistant director shall review the request and issue a written decision. The review may include an informal conference. The decision shall be issued within ten days of receipt of the request for review.

(4) The Authority’s decision is final.

(5) If the Authority’s decision rules in favor of the individual, the restricted individual’s access restriction shall be immediately lifted. If the decision is unfavorable to the restricted individual, the restricted individual may seek further review after six months have lapsed since the date of issuance by following the process described in this rule.

Stat. Auth.: ORS 413.042

Stats. Implemented: ORS 413.042, 654.010

Hist.: OHA 7-2011(Temp), f. & cert. ef. 7-1-11 thru 12-27-11; OHA 18-2011, f. 8-30-11, cert. ef. 9-1-11

 

Rule Caption: Establish policy of non-discrimination against individuals with disabilities

Adm. Order No.: OHA 19-2011

Filed with Sec. of State: 8-30-2011

Certified to be Effective: 9-1-11

Notice Publication Date: 8-1-2011

Rules Adopted: 943-005-0000, 943-005-0005, 943-005-0010, 943-005-0015, 943-005-0020, 943-005-0025, 943-005-0030

Rules Repealed: 943-005-0000(T), 943-005-0005(T), 943-005-0010(T), 943-005-0015(T), 943-005-0020(T), 943-005-0025(T), 943-005-0030(T)

Subject: These rules establish the Authority policy of non-discrimination on the basis of disability in accordance with the Americans with Disabilities Act of 1990 (ADA) and Section 504 of the Rehabilitation Act of 1973. The rules establish Authority policy for communication and accessibility for clients, client applicants and the public. The intent and content of the rules is to mirror existing Federal civil rights laws and to strengthen the Authority practice of these laws.

Rules Coordinator: Evonne Alderete—(503) 932-9663

943-005-0000

Purpose

These rules (OAR 943-005-0000 through 943-005-0030) establish an Oregon Health Authority policy of non-discrimination on the basis of disability in accordance with the Americans with Disabilities Act of 1990 (ADA) and Section 504 of the Rehabilitation Act of 1973.

Stat. Auth.: ORS 413.042

Stats. Implemented: ORS 413.042

Hist.: OHA 5-2011(Temp), f. & cert. ef. 7-1-11 thru 12-27-11; OHA 19-2011, f. 8-30-11, cert. ef. 9-1-11

943-005-0005

Definitions

The following definitions apply to OAR 943-005-0000 through 943-005-0030:

(1) “Alternate Format Communication” means printed material converted to a communication style that meets the accessibility needs of individuals with disabilities to achieve “effective communication.” The types of alternate format that the Oregon Health Authority offers include but are not limited to: large print, Braille, audiotape, electronic format (E-mail attachment, diskette, or CD-ROM) and oral presentation.

(2) “Americans with Disabilities Act” is a comprehensive federal law passed in 1990, which prohibits discrimination on the basis of disability in employment, programs and services provided by state and local governments; goods and services provided by private companies; commercial facilities; telecommunications and transportation. The ADA was crafted upon a body of existing legislation, particularly the Rehabilitation Act of 1973 (Section 504), which states that no recipient of federal financial assistance may discriminate against qualified individuals with disabilities solely because of a disability. (Public Law 101-336)

(3) “An Individual with a Disability” means an individual who:

(a) Has a physical or mental impairment that substantially limits one or more major life activities; or

(b) Has a record or history of such an impairment; or

(c) Is regarded as having such an impairment.

(4) “Authority” means the Oregon Health Authority.

(5) “Auxiliary Aids or Services” mean devices or services that meet the accessibility needs of individuals with hearing, cognitive or speech impairments to achieve “effective communication.” The types of auxiliary aids and services that the Authority offers include but are not limited to: qualified sign language interpreters, text telephone (TTYs), oral presentation, note takers and communication through computer keyboarding.

(6) “Direct threat” means a significant risk to the health or safety of others that cannot be eliminated or reduced to an accepted level through the provision of auxiliary aids and services or through reasonably modifying policies, practices or procedures, that person is not considered a qualified individual with a disability and may be excluded from Authority programs services or activities.

(7) “Federal Discrimination Complaint” means a complaint by a client, client applicant or specific class of individuals or their representative filed with a federal agency alleging an act of discrimination by a public entity.

(8) “Qualified Individual with a Disability” means an individual who can meet the essential eligibility requirements for the program, service or activity with or without reasonable modification of rules, policies or procedures, or the provision of auxiliary aids and services.

(9) “Reasonable Modifications” means a modification of policies, practices or procedures made to a program or service that allows an individual with a disability to participate equally in the program or benefit from the service.

(10) “Report of Discrimination” means a report filed with the Authority by a client, client applicant or specific class of individuals or their representative alleging an act of discrimination by the Authority or an Authority contractor, their agents or subcontractors, or a governmental entity under intergovernmental agreement with the Authority, regarding delivery of Authority services, programs or activities that are subject to Title II of the ADA or Section 504 of the Rehabilitation Act.

Stat. Auth.: ORS 413.042

Stats. Implemented: ORS 413.042

Hist.: OHA 5-2011(Temp), f. & cert. ef. 7-1-11 thru 12-27-11; OHA 19-2011, f. 8-30-11, cert. ef. 9-1-11

943-005-0010

Non-discrimination

(1) No qualified individual with a disability shall, on the basis of disability, be discriminated against, be excluded from participation in, or be denied the benefits of the services, programs or activities of the Authority. In providing any benefit or service, the Authority may not, directly or through contractual or other arrangements, on the basis of a disability deny a qualified individual the opportunity to participate in a service, program or activity or to receive the benefit or services offered. The Authority may not discriminate against a qualified individual with a disability, on the basis of disability in the granting of licenses and certificates.

(2) The Authority shall provide services, programs and activities in the most integrated setting appropriate to the needs of qualified individuals with disabilities within the context of the program being administered. For purposes of this section, “Integrated Setting” means a setting that enables individuals with disabilities to interact with non-disabled persons to the fullest extent possible.

(3) The Authority may not require a qualified individual with a disability to participate in services, programs, or activities that are separate or different, despite the existence of permissibly separate or different programs or activities.

(4) The Authority may not apply eligibility criteria or standards that screen out or tend to screen out an individual with a disability from fully and equally enjoying any goods or services, unless such criteria can be shown to be necessary for the provision of those goods and services or is determined by the Authority to be a legitimate safety requirement.

(5) The Authority shall ensure each program, service, or activity, including public meetings, hearings and events, when viewed in the entirety, is readily accessible to and usable by individuals with disabilities. For purposes of this section, accessible means the ability to approach, enter, operate, participate in, or to use safely and with dignity by a person with a disability.

(6) Nothing in these rules prohibits the Authority from providing benefits or services to individuals with disabilities, or to a particular class of individuals with disabilities, beyond those required by law.

(7) Nothing in these rules requires an individual with a disability to accept a modification, service, opportunity, or benefit provided under these rules that the individual decides not to accept.

(8) The Authority shall provide auxiliary aids and services or alternate format communication to individuals with disabilities where necessary to ensure an equal opportunity to participate in, and enjoy the benefits of, a service, program or activity, unless it would result in a fundamental alteration of the program or an undue financial or administrative burden. Although the Authority shall determine which aid or format, if any, can be provided without fundamental alteration or undue burden, primary consideration should be given to the choice of the requestor.

(9) Except as authorized under specific programs, the Authority is not required to provide personal devices, individually prescribed devices, readers for personal use or study, or services of a personal nature.

(10) The Authority may not assess a charge or fee to an individual with a disability or any group of individuals with disabilities to cover the costs of measures required to provide the individual with the non-discriminatory treatment required by this policy.

(11) The Authority may not deny individuals the opportunity to participate on planning or advisory boards based on their disability.

(12) The Authority may not discriminate against individuals that do not have disabilities themselves, but have a known relationship or association with one or more individuals with disabilities.

(13) The Authority’s determination of direct threat to the health and safety of others must be based on an individualized assessment relying on current medical evidence, or the best available objective evidence that shows:

(a) The nature, duration and severity of the risk,

(b) The probability that a potential injury will actually occur; and

(c) Whether reasonable modifications of policies, practices or procedures will lower or eliminate the risk.

Stat. Auth.: ORS 413.042

Stats. Implemented: ORS 413.042

Hist.: OHA 5-2011(Temp), f. & cert. ef. 7-1-11 thru 12-27-11; OHA 19-2011, f. 8-30-11, cert. ef. 9-1-11

943-005-0015

Illegal Drug Use

(1) Except as provided in section (2) of this rule, OAR 943-005-0000 through 943-005-0030 does not prohibit discrimination against an individual based on that individual’s current illegal use of drugs.

(2) The Authority may not deny health services or services provided in connection with drug rehabilitation to an individual on the basis of that individual’s current use of drugs, if the individual is otherwise entitled to such services. However, a drug rehabilitation or treatment program may deny participation to individuals who engage in illegal use of drugs while they are in the program.

(3) A program may adopt reasonable policies related to drug testing that are designed to ensure that an individual who formerly engaged in the illegal use of drugs is not now engaging in the current illegal use of drugs.

(4) A client with a psychoactive substance use disorder resulting from current illegal use of drugs is not considered to have a disability under OAR 943-005-0000 through 943-005-0030 unless the client has a disability due to another condition.

Stat. Auth.: ORS 413.042

Stats. Implemented: ORS 413.042

Hist.: OHA 5-2011(Temp), f. & cert. ef. 7-1-11 thru 12-27-11; OHA 19-2011, f. 8-30-11, cert. ef. 9-1-11

943-005-0020

Reasonable Modifications

(1) The Authority shall make reasonable modifications to policies, practices or procedures of a program, services or activity when the modifications are necessary to avoid discrimination based on disability unless the modification would fundamentally alter the nature of the program, service or activity or create an undue administrative or financial burden.

(2) When providing program access to a qualified individual with a disability would cause a fundamental alteration of the program, service or activity or undue financial or administrative burden, the Authority shall, to the extent the benefit of the program, service or activity can be achieved, provide program access to the point at which the program becomes fundamentally altered or experiences an undue burden.

(3) Alternate format communication is considered to be within the scope of reasonable modifications.

Stat. Auth.: ORS 413.042

Stats. Implemented: ORS 413.042

Hist.: OHA 5-2011(Temp), f. & cert. ef. 7-1-11 thru 12-27-11; OHA 19-2011, f. 8-30-11, cert. ef. 9-1-11

943-005-0025

Requesting a Reasonable Modification

(1) To request a reasonable modification to an Authority program, service, or activity a client applicant, client or public member must submit to program staff a request for a reasonable modification to the applicable program. Requests may be made verbally or by completing the Request for Reasonable Modification form.

(2) Upon receipt of a request for modification the Authority shall:

(a) Determine whether additional documentation regarding the claimed disability is needed and request such documentation;

(b) Within 15 working days of the request or the receipt of additional medical documentation, whichever is later, provide to the requestor notification of approval, approval with alternative modifications or denial of the request for reasonable modification. All denials and approvals with alternative modifications that were not requested shall be clearly labeled a “Preliminary Notification Subject to Review.”; and

(c) Ensure that approved modifications occur within a reasonable time.

(3) A “Reasonable Modification Team” (Team) means a two person team appointed by program managers that meet to evaluate a Request for Reasonable Modification decision that either denied the request or approved the request but with modifications other than those requested.

(4) This process may include additional communication with the individual requesting the reasonable modifications.

(5) Preliminary Notifications shall be reviewed by a Reasonable Modification Team, which shall notify the requestor of the final result of the review within 15 working days of the preliminary notification or within 15 working days following receipt of medical or other supporting documentation requested by the Team, whichever is later.

(6) An individual whose request for reasonable modification has been denied or approved with alternative modifications which the individual believes to be inadequate may file a Report of Discrimination with the Authority within 60 days of the final result or file a complaint with the appropriate federal regulatory agency within 180 days of the final result.

Stat. Auth.: ORS 413.042

Stats. Implemented: ORS 413.042

Hist.: OHA 5-2011(Temp), f. & cert. ef. 7-1-11 thru 12-27-11; OHA 19-2011, f. 8-30-11, cert. ef. 9-1-11

943-005-0030

Report of Discrimination and Other Remedies Available for Alleged Discrimination

(1) A client or client applicant or specific class of individuals or their representative may file with the Authority a Report of Discrimination based on disability in the following circumstances:

(a) The final result under OAR 943-005-0025 for a Reasonable Modification Request was denied or was approved with an alternative to the requested modification which is believed to be inadequate;

(b) A request for auxiliary aids and services was denied or was approved with an alternative to the request which is believed to be inadequate;

(c) A request for an alternate format communication was denied or was approved with an alternative to the request which is believed to be inadequate;

(d) Inability to access facilities used for Authority programs;

(e) Denial of participation in Authority programs and services.

(2) A Report of Discrimination must be filed within 60 calendar days of the date of the alleged discrimination unless otherwise set forth in these rules

(3) A Report of Discrimination may be submitted verbally or on a Report of Discrimination Form available at any Authority office or by calling any Authority office.

(4) The claim of discrimination shall be investigated and shall include an interview with the complainant. At the conclusion of the investigation, a Letter of Determination shall be issued within 40 calendar days from the receipt of the Discrimination Report.

(5) An individual may appeal the Letter of Determination to the Civil Rights Review Board (CRRB) within 30 calendar days of receiving the Letter of Determination. CRRB means a panel of Authority employees appointed by the Director that reviews the decisions made by the Authority ADA Coordinator or the Civil Rights Investigator on discrimination complaints filed with the Authority.

(6) At the discretion of CRRB, this may include additional communication with the client.

(7) The remedies available under OAR 943-005-0000 through 943-005-0030 are available in addition to other remedies available under state or federal law or Oregon Administrative Rules, except that these remedies must be exhausted where exhaustion is a requirement of seeking remedies in another forum.

Stat. Auth.: ORS 413.042

Stats. Implemented: ORS 413.042

Hist.: OHA 5-2011(Temp), f. & cert. ef. 7-1-11 thru 12-27-11; OHA 19-2011, f. 8-30-11, cert. ef. 9-1-11

 

Rule Caption: Provider Enrollment and Claiming using Medicaid Management Information System

Adm. Order No.: OHA 20-2011

Filed with Sec. of State: 8-30-2011

Certified to be Effective: 9-1-11

Notice Publication Date: 8-1-2011

Rules Adopted: 943-120-0300, 943-120-0310, 943-120-0320, 943-120-0325, 943-120-0330, 943-120-0340, 943-120-0350, 943-120-0360, 943-120-0370, 943-120-0380, 943-120-0400

Rules Repealed: 943-120-0300(T), 943-120-0310(T), 943-120-0320(T), 943-120-0325(T), 943-120-0330(T), 943-120-0340(T), 943-120-0350(T), 943-120-0360(T), 943-120-0370(T), 943-120-0380(T), 943-120-0400(T)

Subject: The Authority is adopting Authority-wide provider rules (OAR 943-120-0300 to 943-120-0380) which govern provider enrollment and claiming using the Medicaid Management Information System (MMIS). These rules ensure that Oregon Medicaid clients will be able to receive consistent and uninterrupted service and that providers are assured their correct and appropriate reimbursement at times that necessitate exceptions to normal, ongoing communications.

Rules Coordinator: Evonne Alderete—(503) 932-9663

943-120-0300

Definitions

The following definitions apply to OAR 943-120-0300 to 943-120-0400:

(1) “Abuse” means provider practices that are inconsistent with sound fiscal, business, or medical practices resulting in an unnecessary cost to the Oregon Health Authority, or in reimbursement for services that are not medically necessary or that fail to meet professionally recognized standards for health care. It also includes actions by clients or recipients that result in unnecessary cost to the Oregon Health Authority.

(2) “Advance Directive” means a form that allows an individual to have another individual make health care decisions when he or she cannot make decisions and informs a doctor if the individual does not want any life sustaining help if he or she is near death.

(3) “Authority” means the Oregon Health Authority.

(4) “Benefit Package” means the package of covered health care services for which the client is eligible.

(4) “Billing Agent or Billing Service” means a third party or organization that contracts with a provider to perform designated services in order to facilitate claim submission or electronic transactions on behalf of the provider.

(5) “Billing Provider” means an individual, agent, business, corporation, clinic, group, institution, or other entity who, in connection with submission of claims to the Authority, receives or directs payment from the Authority on behalf of a performing provider and has been delegated the authority to obligate or act on behalf of the performing provider.

(6) “Children’s Health Insurance Program (CHIP)” means a federal and state funded portion of the Oregon Health Plan (OHP) established by Title XXI of the Social Security Act and administered by the Division of Medical Assistance Programs.

(7) “Claim” means a bill for services, a line item of a service, or all services for one client within a bill. Claim includes a bill or an encounter associated with requesting reimbursement, whether submitted on paper or electronically. Claim also includes any other methodology for requesting reimbursement that may be established in contract or program-specific rules.

(8) “Client or Recipient” means an individual found eligible by the Authority to receive services under the OHP demonstration, medical assistance program, or other public assistance programs administered by the Authority. The following OHP categories are eligible for enrollment:

(a) Temporary Assistance to Needy Families (TANF) are categorically eligible families with income levels under current TANF eligibility rules;

(b) CHIP children under one year of age whose household has income under 185% Federal Poverty Level (FPL) and do not meet one of the other eligibility classifications;

(c) Poverty Level Medical (PLM) adults under 100% of the FPL and clients who are pregnant women with income under 100% of FPL;

(d) PLM adults over 100% of the FPL are clients who are pregnant women with income between 100% and 185% of the FPL;

(e) PLM children under one year of age who have family income under 133% of the FPL or were born to mothers who were eligible as PLM adults at the time of the child’s birth;

(f) PLM or CHIP children one through five years of age who have family income under 185% of the FPL and do not meet one of the other eligibility classifications;

(g) PLM or CHIP children six through 18 years of age who have family income under 185% of the FPL and do not meet one of the other eligibility classifications;

(h) OHP adults and couples are clients age 19 or over and not Medicare eligible, with income below 100% of the FPL who do not meet one of the other eligibility classifications, and do not have an unborn child or a child under age 19 in the household;

(i) OHP families are clients, age 19 or over and not Medicare eligible, with income below 100% of the FPL who do not meet one of the other eligibility classifications, and have an unborn child or a child under the age of 19 in the household;

(j) General Assistance (GA) recipients are clients who are eligible by virtue of their eligibility under the GA program, ORS 411.710 et seq.;

(k) Assistance to Blind and Disabled (AB/AD) with Medicare eligibles are clients with concurrent Medicare eligibility with income levels under current eligibility rules;

(l) AB/AD without Medicare eligibles are clients without Medicare with income levels under current eligibility rules;

(m) Old Age Assistance (OAA) with Medicare eligibles are clients with concurrent Medicare Part A or Medicare Parts A and B eligibility with income levels under current eligibility rules;

(n) OAA with Medicare Part B only are OAA eligibles with concurrent Medicare Part B only income under current eligibility rules;

(o) OAA without Medicare eligibles are clients without Medicare with income levels under current eligibility rules; or

(p) Children, Adults and Families (CAF) children are clients with medical eligibility determined by CAF or Oregon Youth Authority (OYA) receiving OHP under ORS 414.025, 418.034, and 418.189 to 418.970. These individuals are generally in placement outside of their homes and in the care or custody of CAF or OYA.

(9) “Client Representative” means an individual who can make decisions for clients who are not able to make such decisions themselves. For purposes of medical assistance, a client representative may be, in the following order of priority, an individual who is designated as the client’s health care representative under ORS 127.505(12), a court-appointed guardian, a spouse or other family member as designated by the client, the individual service plan team (for developmentally disabled clients), an Authority case manager, or other Authority designee. To the extent that other Authority programs recognize other individuals who may act as a client representative, that individual may be considered the client representative.

(10) “Clinical Records” means the medical, dental, or mental health records of a client. These records include the Primary Care Provider (PCP) records, the inpatient and outpatient hospital records and the Exceptional Needs Care Coordinator (ENCC), complaint and disenrollment for cause records which may be located in the Prepaid Health Plan (PHP) administrative offices.

(11) “Conviction or Convicted” means that a judgment of conviction has been entered by a federal, state, or local court, regardless of whether an appeal from that judgment is pending.

(12) “Covered Services” means medically appropriate health services or items that are funded by the legislature and described in ORS Chapter 414, including OHP authorized under ORS 414.705 to 414.750, and applicable Authority rules describing the benefit packages of covered services except as excluded or limited under OAR 410-141-0500 or such other public assistance services provided to eligible clients under program-specific requirements or contracts by providers required to enroll with the Authority under OAR 943-120-0300 to 943-120-0400.

(13) “Date of Service” means the date on which the client receives medical services or items, unless otherwise specified in the appropriate provider rules.

(14) “Authority” means the Oregon Health Authority.

(15) “Diagnosis Code” means the code as identified in the International Classification of Diseases, 9th Revision, Clinical Modification (ICD-9-CM). The primary diagnosis code is shown in all billing claims and PHP encounters, unless specifically excluded in individual provider rules. Where they exist, diagnosis codes must be shown to the degree of specificity outlined in OAR 943-120-0340 (claim and PHP encounter submission).

(16) “Electronic Data Transaction (EDT)” means the electronic exchange of business documents from application to application in a federally mandated format or, if no federal standard has been promulgated, conducted by either web portal or electronic data interchange pursuant to the Authority’s electronic data transaction rule (OAR 943-120-0100 to 943-120-0200).

(17) “Exclusion” means the Authority may not reimburse a specific provider who has defrauded or abused the Authority for items or services that a provider furnished.

(18) “False Claim” means a claim or PHP encounter that a provider knowingly submits or causes to be submitted that contains inaccurate or misleading information, and that information would result, or has resulted, in an overpayment or improper use for per capita cost calculations.

(19) “Fraud” means an intentional deception or misrepresentation made by an individual with the knowledge that the deception could result in some unauthorized benefit to himself or herself, or some other individual. It includes any act that constitutes fraud or false claim under applicable federal or state law.

(20) “Healthcare Common Procedure Coding System (HCPCS)” means a method for reporting health care professional services, procedures and supplies. HCPCS consists of the Level 1 -- American Medical Association’s Physicians’ Current Procedural Terminology (CPT), Level II -- National Codes and Level III -- Local Codes.

(21) “Health Insurance Portability and Accountability Act (HIPAA)” means a federal law (Public Law 104-191, August 21, 1996) with the legislative objective to assure health insurance portability, reduce health care fraud and abuse, enforce standards for health information and guarantee security and privacy of health information.

(22) “Hospice” means a public agency or private organization or subdivision of either that is primarily engaged in providing care to terminally ill individuals, is certified for Medicare, accredited by the Oregon Hospice Association, and is listed in the Hospice Program Registry.

(23) “Individual Adjustment Request” means a form (DMAP 1036) used to resolve an incorrect payment on a previously paid claim, including underpayments or overpayments.

(24) “Medicaid” means a federal and state funded portion of the medical assistance program established by Title XIX of the Social Security Act, as amended, and administered in Oregon by the Authority.

(25) “Medicaid Management Information System (MMIS)” means the automated claims processing and information retrieval system for handling all Medicaid transactions. The objectives of the system include verifying provider enrollment and client eligibility, managing health care provider claims and benefit package maintenance, and addressing a variety of Medicaid business needs.

(26) “Medical Assistance Program” means a program for payment of health care provided to eligible Oregonians. Oregon’s medical assistance program includes Medicaid services including the OHP Medicaid Demonstration, and CHIP. The medical assistance program is administered and coordinated by DMAP, a division of the Authority.

(27) “Medically Appropriate” means services and medical supplies that are required for prevention, diagnosis, or treatment of a health condition that encompasses physical or mental conditions, or injuries and which are:

(a) Consistent with the symptoms or treatment of a health condition;

(b) Appropriate with regard to standards of good health practice and generally recognized by the relevant scientific community, evidence based medicine, and professional standards of care as effective;

(c) Not solely for the convenience of a client or a provider of the service or medical supplies; and

(d) The most cost effective of the alternative levels of medical services or medical supplies that can be safely provided to a client in the provider’s judgment.

(28) “Medicare” means the federal health insurance program for the aged and disabled administered by the Centers for Medicare and Medicaid Services (CMS) under Title XVIII of the Social Security Act.

(29) “National Provider Identification (NPI)” means a federally directed provider number mandated for use on HIPAA covered transactions by individuals, provider organizations, and subparts of provider organizations that meet the definition of health care provider (45 Code of Federal Regulations (CFR) 160.103) and who conduct HIPAA covered transactions electronically.

(30) “Non-Covered Services” means services or items for which the Authority is not responsible for payment. Non-covered services are identified in:

(a) OAR 410-120-1200, Excluded Services and Limitations;

(b) OAR 410-120-1210, Medical Assistance Benefit Packages and Delivery System;

(c) OAR 410-141-0480, OHP Benefit Package of Covered Services;

(d) OAR 410-141-0520, Prioritized List of Health Services; and

(e) The individual Authority provider rules, program-specific rules, and contracts.

(31) “Non-Participating Provider” means a provider who does not have a contractual relationship with the PHP.

(32) “Nursing Facility” means a facility licensed and certified by the Department of Human Services Seniors and People with Disabilities Division (SPD) defined in OAR 411-070-0005.

(33) “Oregon Health Plan (OHP)” means the Medicaid demonstration project that expands Medicaid eligibility to eligible clients. The OHP relies substantially upon prioritization of health services and managed care to achieve the public policy objectives of access, cost containment, efficacy, and cost effectiveness in the allocation of health resources.

(34) “Out-of-State Providers” means any provider located outside the borders of Oregon:

(a) Contiguous area providers are those located no more than 75 miles from the border of Oregon;

(b) Non-contiguous area providers are those located more than 75 miles from the borders of Oregon.

(35) “Post-Payment Review” means review of billings or other medical information for accuracy, medical appropriateness, level of service, or for other reasons subsequent to payment of the claim.

(36) “Prepaid Health Plan (PHP)” means a managed health, dental, chemical dependency, physician care organization, or mental health care organization that contracts with DMAP or Addictions and Mental Health Division (AMH) on a case managed, prepaid, capitated basis under the OHP. PHP’s may be a Dental Care Organization (DCO), Fully Capitated Health Plan (FCHP), Mental Health Organization (MHO), Primary Care Organization (PCO) or Chemical Dependency Organization (CDO).

(37) “Prohibited Kickback Relationships” means remuneration or payment practices that may result in federal civil penalties or exclusion for violation of 42 CFR 1001.951.

(38) “PHP Encounter” means encounter data submitted by a PHP or by a provider in connection with services or items reimbursed by a PHP.

(39) “Prior Authorization” means payment authorization for specified covered services or items given by Authority staff, or its contracted agencies, or a county if required by the county, prior to provision of the service. A physician or other referral is not a prior authorization.

(40) “Provider” means an individual, facility, institution, corporate entity, or other organization which supplies health care or other covered services or items, also termed a performing provider, that must be enrolled with the Authority pursuant to OAR 943-120-0300 to 943-120-0400 to seek reimbursement from the Authority, including services provided, under program-specific rules or contracts with the Authority or with a county or PHP.

(41) “Quality Improvement” means the effort to improve the level of performance of key processes in health services or health care. A quality improvement program measures the level of current performance of the processes, finds ways to improve the performance and implements new and better methods for the processes. Quality improvement includes the goals of quality assurance, quality control, quality planning, and quality management in health care where “quality of care is the degree to which health services for individuals and populations increase the likelihood of desired health outcomes and are consistent with current professional knowledge.”

(42) “Quality Improvement Organization (QIO)” means an entity which has a contract with CMS under Part B of Title XI to perform utilization and quality control review of the health care furnished, or to be furnished, to Medicare and Medicaid clients; formerly known as a “Peer Review Organization.”

(43) “Remittance Advice” means the automated notice a provider receives explaining payments or other claim actions.

(44) “Subrogation” means the right of the state to stand in place of the client in the collection of third party resources, including Medicare.

(45) “Suspension” means a sanction prohibiting a provider’s participation in the Authority’s medical assistance or other programs by deactivation of the assigned provider number for a specified period of time or until the occurrence of a specified event.

(46) “Termination” means a sanction prohibiting a provider’s participation in the Authority’s programs by canceling the assigned provider number and agreement unless:

(a) The exceptions cited in 42 CFR 1001.221 are met; or

(b) Otherwise stated by the Authority at the time of termination.

(47) “Third Party Resource (TPR)” means a medical or financial resource, including Medicare, which, by law, is available and applicable to pay for covered services and items for a medical assistance client.

(48) “Usual Charge” means when program-specific or contract reimbursement is based on usual charge, and is the lesser of the following, unless prohibited from billing by federal statute or regulation:

(a) The provider’s charge per unit of service for the majority of non-medical assistance users of the same service based on the preceding month’s charges;

(b) The provider’s lowest charge per unit of service on the same date that is advertised, quoted, or posted. The lesser of these applies regardless of the payment source or means of payment; or

(c) Where the provider has established a written sliding fee scale based upon income for individuals and families with income equal to or less than 200% of the FPL, the fees paid by these individuals and families are not considered in determining the usual charge. Any amounts charged to TPR must be considered.

(49) “Visit Data” means program-specific or contract data collection requirements associated with the delivery of service to clients on the basis of an event such as a visit.

Stat. Auth.: ORS 413.042

Stats. Implemented: ORS 414.065

Hist.: OHA 14-2011(Temp), f. & cert. ef. 7-1-11 thru 12-27-11; OHA 20-2011, f. 8-30-11, cert. ef. 9-1-11

943-120-0310

Provider Requirements

(1) All providers seeking reimbursement from the Authority, a PHP, or a county pursuant to a county agreement with the Authority for the provision of covered services or items to eligible recipients, must comply with these rules, OAR 943-120-0300 to 943-120-0400, and the applicable rules or contracts of the specific programs described below:

(a) Programs administered by DMAP including the OHP and the medical assistance program that reimburses providers for services or items provided to eligible recipients, including but not limited to chapter 410, division 120; chapter 410, division 141; and provider rules in chapter 410 applicable to the provider’s service category;

(b) Programs administered by AMH that reimburse providers for services or items provided to eligible AMH recipients; or

(c) Programs administered by SPD that reimburse providers for services or items provided to eligible SPD recipients.

(2) Authority programs use visit data to monitor service delivery, planning, and quality improvement activities. Visit data must be submitted by a program-specific rule or contract. A provider shall make accurate, complete, and timely submission of visit data. Visit data is not a HIPAA transaction and does not constitute a claim for reimbursement.

(3) CHIP and Medicaid-Funded Covered Services and Items.

(a) Covered services or items paid for with Medicaid (Title XIX) and CHIP (Title XXI) funds (referred to as the medical assistance program) are also subject to federal and state Medicaid rules and requirements. In interpreting these rules and program-specific rules or contracts, the Authority shall construe them as much as possible in a manner that shall comply with federal and state medical assistance program laws and regulations, and the terms and conditions of federal waivers and the state plans

(b) If a provider is reimbursed with medical assistance program funds, the provider must comply with all applicable federal and state laws and regulations pertaining to the provision of Medicaid services under the Medicaid Act, Title XIX, 42 United States Code (USC) 1396 et. seq., and CHIP services under Title XXI, including without limitation:

(A) Maintaining all records necessary to fully disclose the extent of the services provided to individuals receiving medical assistance and furnish such information to any state or federal agency responsible for administration or oversight of the medical assistance program regarding any payments claimed by an individual or institution for providing Medicaid services as the state or federal agency may from time to time request;

(B) Complying with all disclosure requirements of 42 CFR 1002.3(a) and 42 CFR 455 subpart (B);

(C) Maintaining written notices and procedures respecting advance directives in compliance with 42 USC 1396(a)(57) and (w), 42 CFR 431.107(b)(4), and 42 CFR 489 subpart I;

(D) Certifying that the information is true, accurate and complete when submitting claims or PHP encounters for the provision of medical assistance services or items. Submission of a claim or PHP encounter constitutes a representation of the provider’s understanding that payment of the claim shall be from federal or state funds, or both and that any falsification or concealment of a material fact may result in prosecution under federal or state laws.

(c) Hospitals, nursing facilities, home health agencies (including those providing personal care), hospices, and HMOs must comply with the Patient Self-Determination Act as set forth in Section 4751 of OBRA 1991. To comply with the obligation under the above-listed laws to deliver information on the rights of the individual under Oregon law to make health care decisions, the named providers and organizations must give capable individuals over the age of 18 a copy of “Your Right to Make Health Care Decisions in Oregon,” copyright 1993, by the Oregon State Bar Health Law Section. Out-of-state providers of these services must comply with Medicare and Medicaid regulations in their state. Submittal to the Authority of the appropriate claim form requesting payment for medical services provided to a Medicaid eligible shall be considered representation to the Authority of the medical provider’s compliance with the above-listed laws.

(d) Payment for any service or item furnished by a provider of CHIP or Medicaid-funded services or items may not be made by or through (directly or by power of attorney) any individual or organization, such as a collection agency or service bureau, that advances money to a provider for accounts receivable that the provider has assigned, sold, or transferred to the individual or organization for an added fee or a deduction of a portion of the accounts receivable.

(e) The Authority shall make medical assistance provider payments only to the following:

(A) The provider who actually performed the service or provided the item;

(B) In accordance with a reassignment from the provider to a government agency or reassignment by a court order;

(C) To the employer of the provider, if the provider is required as a condition of employment to turn over his or her fees to the employer, and the employer is enrolled with the Authority as a billing provider;

(D) To the facility in which the service is provided, if the provider has a contract under which the facility submits the claim, and the facility is enrolled with the Authority as a billing provider;

(E) To a foundation, PHP, clinic, or similar organization operating as an organized health care delivery system, if the provider has a contract under which the organization submits the claim, and the organization is enrolled with the Authority as a billing provider; or

(F) To an enrolled billing provider, such as a billing service or an accounting firm that, in connection with the submission of claims, receives or directs payments in the name of the provider, if the billing provider’s compensation for this service is:

(i) Related to the cost of processing the billing;

(ii) Not related on percentage or other basis to the amount that is billed or collected and not dependent upon the collection of the payment.

(f) Providers must comply with TPR requirements in program-specific rules or contracts.

(4) The Authority uses several approaches to promote program integrity. These rules describe program integrity actions related to provider payments, including provider reimbursement under program-specific rules, county agreements, and contracts. The program integrity goal is to pay the correct amount to a properly enrolled provider for covered services provided to an eligible client according to the program-specific coverage criteria in effect on the date of service.

(a) Program integrity activities include but are not limited to the following:

(A) Medical or professional review including but not limited to following the evaluation of care in accordance with evidence-based principles, medical error identification, and prior authorization processes, including all actions taken to determine the coverage and appropriateness of services or items;

(B) Provider obligations to submit correct claims and PHP encounters;

(C) Onsite visits to verify compliance with standards;

(D) Implementation of HIPAA electronic transaction standards to improve accuracy and timeliness of claims processing and encounter reporting;

(E) Provider credentialing activities;

(F) Accessing federal Department of Health and Human Services (DHHS) database (exclusions);

(G) Quality improvement activities;

(H) Cost report settlement processes;

(I) Audits;

(J) Investigation of false claims, fraud or prohibited kickback relationships; and

(K) Coordination with the Department of Justice Medicaid Fraud Control Unit (MFCU) and other health oversight authorities.

(b) The following individuals may review a request for services or items, or audit a claim or PHP encounter for care, services, or items, before or after payment, for assurance that the specific care, item, or service was provided pursuant to the program-specific and the generally accepted standards of a provider’s field of practice or specialty:

(A) Authority staff or designee;

(B) Medical utilization and professional review contractor;

(C) Dental utilization and professional review contractor; or

(D) Federal or state oversight authority.

(c) Payment may be denied or subject to recovery if the review or audit determines the care, service, or item was not provided pursuant to provider rules or does not meet the criteria for quality or medical appropriateness of the care, service, or item or payment. Related provider and hospital billings shall also be denied or subject to recovery.

(d) If the Authority determines that an overpayment has been made to a provider, the amount of overpayment is subject to recovery.

(e) The Authority may communicate with and coordinate any program integrity actions with the MFCU, DHHS, and other federal and state oversight authorities.

[Publications: Publications referenced are available from the agency.]

Stat. Auth.: ORS 413.042

Stats. Implemented: ORS 414.065, 414.115; 414.125; 414.135; & 414.145

Hist.: OHA 14-2011(Temp), f. & cert. ef. 7-1-11 thru 12-27-11; OHA 20-2011, f. 8-30-11, cert. ef. 9-1-11

943-120-0320

Provider Enrollment

(1) In some Authority program areas, being an enrolled Authority provider is a condition of eligibility for an Authority contract for certain services or activities. The Authority requires billing providers to be enrolled as providers consistent with the provider enrollment processes set forth in this rule. If reimbursement for covered services will be made under a contract with the Authority, the provider must also meet the Authority’s contract requirements. Contract requirements are separate from the requirements of these provider enrollment rules. Enrollment as a provider with the Authority is not a promise that the enrolled provider will receive any amount of work from the Authority, a PHP, or a county.

(2). Provider enrollment establishes essential Authority provider participation requirements for becoming an enrolled Authority provider. The details of provider qualification requirements, client eligibility, covered services, how to obtain prior authorization or review (if required), documentation requirements, claims submission, and available electronic access instructions, and other pertinent instructions and requirements are contained in the program-specific rules or contract.

(3) Prior to enrollment, providers must:

(a) Meet all program-specific or contract requirements identified in program-specific rules or contracts in addition to those requirements identified in these rules;

(b) Meet Authority contracting requirements, as specified by the Authority’s Office of Contracts and Procurement (OC&P);

(c) Meet Authority and federal licensing requirements for the type of service for which the provider is enrolling;

(d) Meet Authority and federal certification requirements for the type of service for which the provider is enrolling; and

(e) Obtain a provider number from the Authority for the specific service for which the provider is enrolling.

(4) Participation with the Authority as an enrolled provider is open to qualified providers that:

(a) Meet the qualification requirements established in these rules and program-specific rules or contracts;

(b) Enroll as an Authority provider pursuant to these rules;

(c) Provide a covered service or item within their scope of practice and licensure to an eligible Authority recipient pursuant to program-specific rules or contracts; and

(d) Accept the reimbursement amounts established pursuant to the Authority’s program-specific fee structures or contracts for the service or item.

(5) To be enrolled as an Authority provider, an individual or organization must submit a complete and accurate provider enrollment form, available from the Authority, including all required documentation, and a signed provider enrollment agreement.

(a) The provider enrollment form requests basic demographic information about the provider that will be permanently associated with the provider or organization until changed on an update form.

(b) Each Authority program establishes provider-specific qualifications and program criteria that must be provided as part of the provider enrollment form.

(A) The provider must meet applicable licensing and regulatory requirements set forth by federal and state statutes, regulations, and rules, and must comply with all Oregon statutes and regulations applicable to the provider’s scope of service as well as the program-specific rules or contract applicable to the provision of covered services. The provider and program addendum shall specify the required documentation of professional qualifications that must be provided with the provider enrollment form.

(B) All providers of services within Oregon must have a valid Oregon business license if such a license is a requirement of the state, federal, county, or city government to operate a business or to provide services. In addition providers must be registered to do business in Oregon by registering with the Oregon Secretary of State, Corporation Division, if registration is required.

(c) All individuals and entities shall disclose information used by the Authority to determine whether an exclusion applies that would prevent the Authority from enrolling the provider. Individual performing providers must submit a disclosure statement. All providers that are enrolling as an entity (corporation, non-profit, partnership, sole proprietorship, governmental) must submit a disclosure of ownership and control interest statement. Payment may not be made to any individual or entity that has been excluded from participation in federal or state programs or that employs or is managed by excluded individuals or entities.

(A) Entities must disclose all the information required on the disclosure of ownership and control interest statement. Information that must be disclosed includes the name, address, and taxpayer identification number of each individual with an ownership or control interest in the disclosing entity or in any subcontractor in which the disclosing entity has a direct or indirect ownership of five percent or more; whether any of the named individuals are related as spouse, parent, child, sibling, or other family member by marriage or otherwise; and the name and taxpayer identification number of any other disclosing entity in which an individual with an ownership or control interest in the disclosing entity also has an ownership or control interest.

(B) A provider must submit, within 35 days of the date of a request by DHHS or the Authority, full and complete information about the ownership of any subcontractor with whom the provider had business transactions totaling more than $25,000 during the 12-month period ending on the date of the request; and any significant business transactions between the provider and any wholly owned supplier, or between the provider and any subcontractor, during the five-year period ending on the date of the request.

(C) Before the Authority enters into a provider enrollment agreement with a provider, or renews a provider agreement, or at any time upon written request of the Authority, the provider must disclose to the Authority the identity and taxpayer identification number of any individual who has an ownership or control interest in the provider; or is an agent or managing employee of the provider; or the individual performing provider that has been convicted of a criminal offense related to that individual’s involvement in any program under Medicare, Medicaid, or Title XX services program, since the inception of those programs.

(D) The Authority may refuse to enter into or may suspend or terminate a provider enrollment agreement if the individual performing provider or any individual who has an ownership or control interest in the entity, or who is an agent or managing employee of the provider, has been sanctioned or convicted of a criminal offense related to that individual’s involvement in any program established under Medicare, Medicaid, Children’s Health Insurance, Title XX services, or other public assistance program.

(E) The Authority may refuse to enter into or may suspend or terminate a provider enrollment agreement, or contract for provider services, if it determines that the provider did not fully and accurately make any disclosure required under section (5)(c) of this rule.

(F) Taxpayer identification numbers, including social security numbers (SSN) and employer identification numbers (EIN), must be provided where indicated on the Disclosure Statement or the Disclosure of Ownership and Control Interest Statement. The taxpayer identification number will be used to confirm whether the individual or entity is subject to exclusion from participation in the Oregon Medicaid program.

(6) The provider must sign the provider enrollment agreement, and submit it for review to the Authority at the time the provider submits the provider enrollment form and related documentation. Signing the provider enrollment agreement constitutes agreement by a provider to comply with all applicable Authority provider and program rules, and applicable federal and state laws and regulations in effect on the date of service.

(7) A provider may request to conduct electronic transactions with the Authority by enrolling and completing the appropriate authorization forms pursuant to the electronic data transaction rules (OAR 943-120-0100 to 943-120-0200).

(8). A provider shall be enrolled, assigned, and issued a provider number for use in specific payment or business operations upon the following criteria:

(a) Provider submission of a complete and signed (when applicable), provider enrollment form, provider enrollment agreement, provider certification and all required documents to the Authority program responsible for enrolling the provider. Provider signature must be the provider or an individual with actual authority from the provider to legally bind the provider to attest and certify to the accuracy and completeness of the information submitted;

(b) The Authority’s verification of licensing or certification or other authority to perform the service or provide the item within the lawful scope of practice recognized under Oregon law. The Authority may confirm any information on the provider enrollment form or documentation submitted with the provider enrollment form, and may request additional information; and

(c) The Authority’s acceptance of the provider enrollment form, provider enrollment agreement, and provider certification by the Authority unit responsible for approving the enrollment of the provider.

(9) Submission of a claim or encounter or other reimbursement document constitutes the enrolled provider’s agreement that:

(a) The service or item was provided in compliance with all applicable rules and requirements in effect on the date of service;

(b) The provider has created and maintained all records necessary to disclose the extent of services or items provided and provider’s compliance with applicable program and financial requirements, and that the provider agrees to make such information available upon request to the Authority, the MFCU (for Medicaid-funded services or items), the Oregon Secretary of State, and (for federally-funded services or items) the federal funding authority and the Comptroller General of the United States, or their designees;

(c) The information on the claim or encounter, regardless of the format or other reimbursement document is true, accurate and complete; and

(d) The provider understands that payment of the claim or encounter or other reimbursement document will be from federal or state funds, or a combination of federal and state funds, and that any falsification, or concealment of a material fact, may result in prosecution under federal and state laws.

(10) The Authority has taken action to ensure compliance with the NPI requirements pursuant to 45 CFR Part 162 when those requirements became effective on May 23, 2007. In the event of a transition period approved by CMS beyond May 23, 2008, the following requirements for contractors, providers, and provider-applicants shall apply:

(a) Providers and contractors that obtain an NPI must use their NPI where indicated. In situations where a taxonomy code may be used in conjunction with the NPI, providers must update their records as specified with the Authority’s provider enrollment unit. Providers applying for enrollment with the Authority that have been issued an NPI must include that NPI and any associated taxonomy codes with the provider enrollment form;

(b) A provider enrolled with the Authority must bill using the NPI pursuant to 45 CFR part 162.410, in addition to the Authority-assigned provider number, where applicable, and continue to bill using the Authority assigned provider number until the Authority informs the provider that the Authority assigned provider number is no longer allowed, or the NPI transition period has ended, whichever occurs first. Failure to use the NPI and Authority-assigned provider number as indicated during this transition period may result in delay or rejection of claims and other transactions;

(c) The NPI and applicable taxonomy code combinations will be cross-referenced to the Authority assigned provider number for purposes of processing all applicable electronic transactions as specified in OAR 943-120-0100;

(d) The provider and PHP must cooperate with the Authority with reasonable consultation and testing procedures, if any, related to implementation of the use of NPI’s; and

(e) Certain provider types are not eligible for an NPI based on federal criteria for obtaining an NPI. Providers not eligible for an NPI must always use their Authority provider number on claims, encounters, or other reimbursement documents for that specific provider type.

(11) The effective date of provider enrollment is the date the provider’s request is received by the Authority if on that date the provider has met all applicable requirements. The effective date may be retroactive for up to one year to encompass dates on which the provider furnished covered services to a medical assistance recipient for which it has not been paid, if on the retroactive effective date the provider has met all applicable requirements.

(12) Provider numbers are specific to the category of service or items authorized by the Authority. Issuance of an Authority-assigned provider number establishes enrollment of an individual or organization as a provider for the specific category of services covered by the provider and program addendum submitted with the provider enrollment form and enrollment agreement.

(13) Providers must provide the following updates:

(a) An enrolled provider must notify the Authority in writing of a material change in any status or condition on any element of their provider enrollment form. Providers must notify the Authority of changes in any of this information in writing within 30 calendar days of any of the following changes:

(A) Business affiliation;

(B) Ownership;

(C) NPI;

(D) Associated taxonomy codes;

(E) Federal Tax Identification number;

(F) Ownership and control information; or

(G) Criminal convictions.

(b) These changes may require the submission of a provider enrollment form, provider enrollment agreement, provider certification, or other related documentation.

(c) Claims submitted by, or payments made to, providers who have not timely furnished the notification of changes or have not submitted any of the items that are required due to a change may be denied or recovered.

(d) Notice of bankruptcy proceedings must be immediately provided to the Authority in writing.

(14) Tax Reporting and Withholding.

(a) Providers must submit the provider’s SSN for individuals or a federal EIN for entities, whichever is required for tax reporting purposes on IRS Form 1099. Billing providers must submit the SSN or EIN of all performing providers in connection with claims or payments made to or on behalf of the performing provider, in addition to the billing provider’s SSN or EIN. Providing this number is mandatory to be eligible to enroll as a provider. The provider’s SSN or EIN is required pursuant to 42 CFR 433.37 federal tax laws at 26 USC 6041. SSN’s and EIN’s provided pursuant to this authority are used for the administration of state, federal, and local tax laws and the administration of this program for internal verification and administrative purposes including but not limited to identifying the provider for payment and collection activities.

(b) The Authority must comply with the tax information reporting requirements of section 6041 of the Internal Revenue Code (26 USC 6041). Section 6041 requires the filing of annual information returns showing amounts paid to providers, who are identified by name, address, and SSN or EIN. The Authority files its information returns with the Internal Revenue Service (IRS) using Form 1099MISC.

(c) The IRS Code section 3406(a)(1)(B) requires the Authority to begin backup withholding when notified by the IRS that a taxpayer identification number reported on an information return is incorrect. If a provider receives notice of backup withholding from the Authority, the provider must timely comply with the notice and provide the Authority with accurate information. The Authority shall comply with IRS requirements for backup withholding.

(d) Failure to notify the Authority of a change in federal tax identification number (SSN or EIN) may result in the Authority imposing a sanction as specified in OAR 943-120-0360.

(e) If the Authority notifies a provider about an error in federal tax identification number, the provider must supply a valid federal tax identification number within 30 calendar days of the date of the Authority’s notice. Failure to comply with this requirement may result in the Authority imposing a sanction as specified in OAR 943-120-0360, for each time the provider submits an inaccurate federal tax identification number, and may require back-up withholding. Federal tax identification number requirements described in this rule refer to any requirements established by the IRS.

(15) Providers of services to clients outside the State of Oregon must be enrolled as a provider under section (8) of this rule if they comply with the requirements of section (8) and meet the following conditions:

(a) The provider is appropriately licensed or certified and is enrolled in the provider’s home state for participation in that state’s Medicaid program or, for non-Medicaid services, enrolled or contracted with the state agency in the provider’s state to provide the same program-specific service in the provider’s state. Disenrollment or sanction from the other state’s Medicaid program, or exclusion from any other federal or state health care program or comparable program-specific service delivery system is a basis for denial of enrollment, termination, or suspension from participation as an Authority provider;

(b) The Oregon Board of Pharmacy issued a license to provide pharmacy services to a noncontiguous out-of-state pharmacy provider;

(c) The services must be authorized in the manner required for out-of-state services under the program-specific rules or contract for an eligible client;

(d) The services for which the provider bills are covered services under the OHP or other Authority program for which covered services are authorized to be provided to the client;

(e) A facility, including but not limited to a hospital, rehabilitative facility, institution for care of individuals with mental retardation, psychiatric hospital, or residential care facility, is enrolled or contracted by the state agency in the state in which the facility is located or is licensed as a facility provider of services by Oregon; or

(f) If the provider is not domiciled in or registered to do business in Oregon, the provider must promptly provide to the Oregon Department of Revenue and the Oregon Secretary of State, Corporation Division all information required by those agencies relative to the provider enrollment form and provider enrollment agreement. The Authority shall withhold enrollment and payments until the out-of-state provider has provided documentation of compliance with this requirement to the Authority unit responsible for enrollment.

(16) The provider enrollment agreement may be terminated as follows:

(a) The provider may ask the Authority to terminate the provider enrollment agreement at any time, subject to any specific provider termination requirements in program-specific rules or contracts.

(A) The request must be in writing, signed by the provider, and mailed or delivered to the Authority provider enrollment unit. The notice must specify the Authority-assigned provider number, if known.

(B) When accepted, the Authority shall assign the provider number a termination status and the effective date of the termination status.

(C) Termination of the provider enrollment agreement does not relieve the provider of any obligations for covered services or items provided under these rules, program-specific rules or contracts in effect for dates of services during which the provider enrollment agreement was in effect.

(b) The Authority may terminate the provider enrollment agreement immediately upon notice to the provider, or a later date as the Authority may establish in the notice, upon the occurrence of any of the following events:

(A) The Authority fails to receive funding, appropriations, limitations, or other expenditure authority at levels that the Authority or the specific program determines to be sufficient to pay for the services or items covered under the agreement;

(B) Federal or state laws, regulations, or guidelines are modified or interpreted by the Authority in a manner that either providing the services or items under the agreement is prohibited or the Authority is prohibited from paying for such services or items from the planned funding source;

(C) The Authority has issued a final order revoking the Authority-assigned provider number based on a sanction under termination terms and conditions established in program-specific rules or contract;

(D) The provider no longer holds a required license, certificate or other authority to qualify as a provider. The termination shall be effective on the date the license, certificate, or other authority is no longer valid; or

(E) The provider fails to submit any claims for reimbursement for an 18-month period. The provider may reapply for enrollment.

(c) In the event of any dispute arising out of the termination of the provider enrollment agreement, the provider’s sole monetary remedy is limited to covered services or items the Authority determines to be compensable under the provider agreement, a claim for unpaid invoices, hours worked within any limits set forth in the agreement but not yet billed, and Authority-authorized expenses incurred prior to termination. Providers may not recover indirect or consequential damages. Providers are not entitled to attorney fees, costs, or expenses of any kind.

(17) When a provider fails to meet one or more of the requirements governing participation as an Authority enrolled provider, the provider’s Authority- assigned provider number may be immediately suspended, pursuant to OAR 943-120-0360. The provider may not provide services or items to clients during a period of suspension. The Authority shall deny claims for payment or other reimbursement requests for dates of service during a period of suspension.

(18) The provision of program-specific or contract covered services or items to eligible clients is voluntary on the part of the provider. Providers are not required to serve all clients seeking service. If a provider undertakes to provide a covered service or item to an eligible client, the provider must comply with these rules, program-specific rules or contract.

(a) The provider performs all services, or provides all items, as an independent contractor. The provider is not an officer, employee, or agent of the Authority.

(b) The provider is responsible for its employees, and for providing employment-related benefits and deductions that are required by law. The provider is solely responsible for its acts or omissions, including the acts or omissions of its own officers, employees or agents. The Authority’s responsibility is limited to its authorization and payment obligations for covered services or items provided pursuant to these rules.

(19) For Medicaid services, a provider may not deny services to any eligible client because of the client’s inability to pay the cost sharing amount imposed by the applicable program-specific or provider-specific rules or contract. A client’s inability to pay does not eliminate the client’s liability for the cost sharing charge.

[Publications: Publications referenced are available from the agency.]

Stat. Auth.: ORS 413.042

Stats. Implemented: ORS 414.065

Hist.: OHA 14-2011(Temp), f. & cert. ef. 7-1-11 thru 12-27-11; OHA 20-2011, f. 8-30-11, cert. ef. 9-1-11

943-120-0325

Compliance with Federal and State Statutes

(1) When a provider submits a claim for services or supplies provided to an Authority client, the Authority shall consider the submission as the provider’s representation of the provider’s compliance with the applicable sections of the federal and state statutes and rules referenced in this rule, and other program rules or contract requirements of the specific program under which the claim is submitted:

(a) 45 CFR Part 84 which implements Title V, Section 504 of the Rehabilitation Act of 1973;

(b) 42 CFR Part 493 Laboratory Requirements and ORS chapter 438 (Clinical Laboratories).

(c) The provider must comply and, as indicated, require all subcontractors to comply with the following federal and state requirements to the extent that they are applicable to the items and services governed by these rules, unless exempt under 45 CFR Part 87 for Faith-Based Organizations (Federal Register, July 16, 2004, Volume 69, #136), or other federal provisions. For purposes of these rules, all references to federal and state laws are references to federal and state laws as they may be amended from time to time that are in effect on the date of provider’s service:

(A) The provider must comply and require all subcontractors to comply with all federal laws, regulations, executive orders applicable to the items and services provided under these rules. Without limiting the generality of the foregoing, the provider must comply and require all subcontractors to comply with the following laws, regulations and executive orders to the extent they are applicable to the items and services provided under these rules:

(i) Title VI and VII of the Civil Rights Act of 1964, as amended;

(ii) Sections 503 and 504 of the Rehabilitation Act of 1973, as amended;

(iii) The Americans with Disabilities Act of 1990, as amended;

(iv) Executive Order 11246, as amended;

(v) The Health Insurance Portability and Accountability Act of 1996;

(vi) The Age Discrimination in Employment Act of 1967, as amended, and the Age Discrimination Act of 1975, as amended;

(vii) The Vietnam Era Veterans’ Readjustment Assistance Act of 1974, as amended,

(viii) all regulations and administrative rules established pursuant to the foregoing laws;

(viii) All other applicable requirements of federal civil rights and rehabilitation statutes, rules, and regulations;

(ix) All federal laws governing operation of community mental health programs, including without limitation, all federal laws requiring reporting of client abuse. These laws, regulations and executive orders are incorporated by reference herein to the extent that they are applicable to the items and services governed by these rules and required by law to be so incorporated. No federal funds may be used to provide services in violation of 42 USC 14402.

(B) Any provider that receives or makes annual payments under Medicaid of at least $5,000,000, as a condition of receiving such payments, shall:

(i) Establish written policies for all employees of the entity (including management), and of any contractor, subcontractor, or agent of the entity, that provide detailed information about the False Claims Act established under 31 USC 3729 through 3733, administrative remedies for false claims and statements established under 31 USC 38, any Oregon state laws pertaining to civil or criminal penalties for false claims and statements, and whistle blowing protections under such laws, with respect to the role of such laws in preventing and detecting fraud, waste, and abuse in Federal health care programs (as defined in 42 USC 1320a-7b(f));

(ii) Include as part of written policies, detailed provisions regarding the entity’s policies and procedures for detecting and preventing fraud, waste, and abuse; and

(iii) Include in any employee handbook for the entity, a specific discussion of the laws described in sub-paragraph (i), the rights of the employees to be protected as whistleblowers.

(C) If the items and services governed under these rules exceed $10,000, the provider must comply and require all subcontractors to comply with Executive Order 11246, entitled “Equal Employment Opportunity,” as amended by Executive Order 11375, and as supplemented in U.S Authority of Labor regulations (41 CFR part 60);

(D) If the items and services governed under these rules exceed $100,000, and are paid in any part with federal funds, the provider must comply and require all subcontractors to comply with all applicable standards, orders, or requirements issued under Section 306 of the Clean Air Act (42 U.S.C. 7606), the Federal Water Pollution Control Act as amended (commonly known as the Clean Water Act -- 33 U.S.C. 1251 to 1387), specifically including, but not limited to, Section 508 (33 U.S.C. 1368). Executive Order 11738, and Environmental Protection Agency regulations (40 CFR Part 32), which prohibit the use under non-exempt Federal contracts, grants or loans of facilities included on the EPA List of Violating Facilities. Violations must be reported to the Authority, DHHS, and the appropriate Regional Office of the Environmental Protection Agency. The provider must include and require all subcontractors to include in all contracts with subcontractors receiving more than $100,000, language requiring the subcontractor to comply with the federal laws identified in this section;

(E) The provider must comply and require all subcontractors to comply with applicable mandatory standards and policies relating to energy efficiency that are contained in the Oregon energy conservation plan issued in compliance with the Energy Policy and Conservation Act, 42 U.S.C. 6201 et seq. (Pub. L. 94-163);

(F) The provider must provide written certification indicating that:

(i) No federal appropriated funds have been paid or shall be paid, by or on behalf of the provider, to any person for influencing or attempting to influence an officer or employee of an agency, a Member of Congress, an officer or employee of Congress, or an employee of a Member of Congress in connection with the awarding of any federal contract, the making of any federal grant, the making of any federal loan, the entering into of any cooperative agreement, and the extension, continuation, renewal, amendment or modification of any federal contract, grant, loan or cooperative agreement;

(ii) If any funds other than federal appropriated funds have been paid or shall be paid to any person for influencing or attempting to influence an officer or employee of any agency, a Member of Congress, an officer or employee of Congress, or an employee of a Member of Congress in connection with this federal contract, grant, loan or cooperative agreement, the provider must complete and submit Standard Form LLL, “Disclosure Form to Report Lobbying” in accordance with its instructions;

(iii) The provider must require that the language of this certification be included in the award documents for all sub-awards at all tiers (including subcontracts, sub-grants, and contracts under grants, loans, and cooperative agreements) and that all sub-recipients and subcontractors must certify and disclose accordingly;

(iv) This certification is a material representation of fact upon which reliance was placed when this provider agreement was made or entered into. Submission of this certification is a prerequisite for making or entering into this provider agreement imposed by 31 USC 1352. Any person who fails to file the required certification shall be subject to a civil penalty of not less than $10,000 and not more than $100,000 for each such failure.

(G) If the items and services funded in whole or in part with financial assistance provided under these rules are covered by HIPAA or the federal regulations implementing HIPAA, the provider must deliver the goods and services in compliance with HIPAA. The provider must comply and require all subcontractors to comply with the following:

(i) Individually identifiable health information about specific individuals is confidential. Individually identifiable health information relating to specific individuals may be exchanged between the provider and the Authority for purposes directly related to the provision to clients of services that are funded in whole or in part under these rules. The provider must not use or disclose any individually identifiable health information about specific individuals in a manner that would violate Authority privacy rules, (OAR 943-014-0000 to 0070.), or the Authority’s Notice of Privacy Practices, if done by the Authority;

(ii) Providers who engage in EDI transactions with the Authority in connection with claims or encounter data, eligibility or enrollment information, authorizations or other electronic transactions must execute an EDI trading partner agreement with the Authority and must comply with the Authority’s electronic data transmission rules (OAR 943-120-0100 to 943-120-0200);

(iii) If a provider reasonably believes that the provider’s or the Authority’s data transactions system or other application of HIPAA privacy or security compliance policy may result in a violation of HIPAA requirements, the provider must promptly consult the Authority’s privacy officer. The provider or the Authority may initiate a request to test HIPAA transactions, subject to available resources and the Authority’s testing schedule.

(H) The provider must comply and require all subcontractors to comply with all mandatory standards and policies that relate to resource conservation and recovery pursuant to the Resource Conservation and Recovery Act (codified at 42 USC 6901 et. seq.). Section 6002 of that Act (codified at 42 USC 6962) requires that preference be given in procurement programs to the purchase of specific products containing recycled materials identified in guidelines developed by the Environmental Protection Agency. Current guidelines are set forth in 40 CFR Parts 247;

(I) The provider must comply and require all subcontractors to comply with the applicable audit requirements and responsibilities set forth in the Office of Management and Budget Circular A-133 entitled “Audits of States, Local Governments and Non-Profit Organizations;”

(J) The provider may not permit any person or entity to be a subcontractor if the person or entity is listed on the non-procurement portion of the General Service Administration’s “List of Parties Excluded from Federal Procurement or Nonprocurement Programs” pursuant to Executive Orders No. 12,549 and No. 12,689, “Debarment and Suspension”. (See 45 CFR part 76). This list contains the names of parties debarred, suspended, or otherwise excluded by agencies, and providers and subcontractors declared ineligible under statutory authority other than Executive Order No. 12549. Subcontractors with awards that exceed the simplified acquisition threshold must provide the required certification regarding their exclusion status and that of their principals prior to award;

(K) The provider must comply and require all subcontractors to comply with the following provisions to maintain a drug-free workplace:

(i) Certify that it shall provide a drug-free workplace by publishing a statement notifying its employees that the unlawful manufacture, distribution, dispensation, possession, or use of a controlled substance, except as may be present in lawfully prescribed or over-the-counter medications, is prohibited in the provider’s workplace or while providing services to Authority clients. The provider’s notice must specify the actions that shall be taken by the provider against its employees for violation of such prohibitions;

(ii) Establish a drug-free awareness program to inform its employees about the dangers of drug abuse in the workplace, the provider’s policy of maintaining a drug-free workplace, any available drug counseling, rehabilitation, and employee assistance programs, and the penalties that may be imposed upon employees for drug abuse violations;

(iii) Provide each employee to be engaged in the performance of services under these rules a copy of the statement required in paragraph (J)(i) above;

(iv) Notify each employee in the statement required by paragraph (J)(i) that, as a condition of employment to provide services under these rules, the employee shall abide by the terms of the statement and notify the employer of any criminal drug statute conviction for a violation occurring in the workplace no later than five days after the conviction;

(v) Notify the Authority within ten days after receiving notice under paragraph (J)(iv) from an employee or otherwise receiving actual notice of the conviction;

(vi) Impose a sanction on, or require the satisfactory participation in a drug abuse assistance or rehabilitation program by any employee who is convicted as required by Section 5154 of the Drug-Free Workplace Act of 1988;

(vii) Make a good-faith effort to continue a drug-free workplace through implementation of paragraphs (J)(i) through (J)(vi);

(viii) Require any subcontractor to comply with paragraphs (J)(i) through (J)(vii);

(ix) The provider, the provider’s employees, officers, agents, or subcontractors may not provide any service required under these rules while under the influence of drugs. For purposes of this provision, “under the influence” means observed abnormal behavior or impairments in mental or physical performance leading a reasonable person to believe the provider or provider’s employee, officer, agent, or subcontractor has used a controlled substance, prescription, or non-prescription medication that impairs the provider or provider’s employee, officer, agent, or subcontractor’s performance of essential job function or creates a direct threat to Authority clients or others. Examples of abnormal behavior include but are not limited to hallucinations, paranoia or violent outbursts. Examples of impairments in physical or mental performance include but are not limited to slurred speech, difficulty walking or performing job activities;

(x) Violation of any provision of this subsection may result in termination of the provider agreement.

(L) The provider must comply and require all sub-contractors to comply with the Pro-Children Act of 1994 (codified at 20 USC section 6081 et. seq.);

(M) A provider reimbursed or seeking reimbursement with Medicaid funds must comply with all applicable federal and state laws and regulations pertaining to the provision of Medicaid services under the Medicaid Act, Title XIX, 42 USC Section 1396 et. seq., including without limitation:

(i) Maintain necessary records to fully disclose the extent of the services provided to individuals receiving Medicaid assistance and must furnish the information to any state or federal agency responsible for administering the Medicaid program regarding any payments claimed by the provider or institution for providing Medicaid services as the state or federal agency may from time to time request. 42 USC Section 1396a(a)(27); 42 CFR 431.107(b)(1) & (2);

(ii) Comply with all disclosure requirements of 42 CFR 1002.3(a) and 42 CFR 455 Subpart (B);

(iii) Maintain written notices and procedures respecting advance directives in compliance with 42 USC Section 1396(a)(57) and (w), 42 CFR 431.107(b)(4), and 42 CFR 489 subpart I;

(iv) Certify when submitting any claim for the provision of Medicaid services that the information submitted is true, accurate and complete. The provider must acknowledge provider’s understanding that payment of the claim shall be from federal and state funds and that any falsification or concealment of a material fact may be prosecuted under federal and state laws.

(N) Providers must comply with the obligations intended for contractors under ORS 279B.220, 279B.225, 279B.230 and 279B.235 (if applicable), Providers shall, to the maximum extent economically feasible in the performance of covered services, use recycled paper (as defined in ORS 279A.010(1)(ee)), recycled PETE products (as defined in 279A.010(1)(ff)), and other recycled plastic resin products and recycled products (as “recycled product” is defined in 279A.010(1)(gg)).

(O) Providers must comply with all federal, state and local tax laws, including Social Security payment requirements, applicable to payments made by the Authority to the provider.

(2) Hospitals, nursing facilities, home health agencies (including those providing personal care), hospices, and health maintenance organizations shall comply with the Patient Self-Determination Act as set forth in Section 4751 of OBRA 1991. To comply with the obligation under the above listed laws to deliver information on the rights of the individual under Oregon law to make health care decisions, the named providers and organizations must provide capable individuals over the age of 18 a copy of “Your Right to Make Health Care Decisions in Oregon,” copyright 1993, by the Oregon State Bar Health Law Section. Out-of-state providers of these services must comply with Medicare and Medicaid regulations in their state. Submittal to the Authority of the appropriate billing form requesting payment for medical services provided to a Medicaid eligible client shall be deemed representation to the Authority of the medical provider’s compliance with the above-listed laws.

(3) Providers described in ORS chapter 419B must report suspected child abuse to their local Children, Adults and Families Division office or police, in the manner described in ORS chapter 419.

(4) The Clinical Laboratory Improvement Act (CLIA), requires all entities that perform even one laboratory test, including waived tests, on “materials derived from the human body for the purpose of providing information for the diagnosis, prevention or treatment of any disease or impairment of, or the assessment of the health of, human beings” to meet certain federal requirements. If an entity performs tests for these purposes, it is considered, under CLIA, to be a laboratory.

[Publication: Publications referenced are available from the agency.]

Stat. Auth.: ORS 413.042

Stats. Implemented: ORS 414.065

Hist.: OHA 14-2011(Temp), f. & cert. ef. 7-1-11 thru 12-27-11; OHA 20-2011, f. 8-30-11, cert. ef. 9-1-11

943-120-0330

Billing Procedures

(1) These rules only apply to covered services and items provided to clients that are paid for by the Authority based on an Authority fee schedule or other reimbursement method (often referred to as fee-for-service), or for services that are paid for by the Authority at the request of a county for county-authorized services. .

(a) If a client’s service or item is paid for by a PHP, the provider must comply with the billing and procedures related to claim submission established under contract with that PHP, or the rules applicable to non-participating providers if the provider is not under contract with that PHP.

(b) If the client is enrolled in a PHP, but the client is permitted by a contract or program-specific rules to obtain covered services reimbursed by the Authority (such as family planning services that may be obtained from any provider), the provider must comply with the billing and claim procedures established under these rules.

(2) All Authority-assigned provider numbers are issued at enrollment and are directly associated with the provider as defined in OAR 943-120-0320(12) and have the following uses:

(a) Log-on identification for the Authority web portal;

(b) Claim submission in the approved paper formats; and

(c) For electronic claims submission including the web portal for atypical providers pursuant to 45 CFR 160 and 162 where an NPI is not mandated. Use of the Authority-assigned provider number shall be considered authorized by the provider and the provider shall be accountable for its use.

(3) Except as provided in section (4) below, an enrolled provider may not seek payment for any covered services from:

(a) A client for covered benefits; or

(b) A financially responsible relative or representative of that client.

(4) Providers may seek payment from an eligible client or client representative as follows:

(a) From any applicable coinsurance, co-payments, deductibles, or other client financial obligation to the extent and as expressly authorized by program-specific rules or contract;

(b) From a client who failed to inform the provider of Authority program eligibility, of OHP or PHP enrollment, or of other third party insurance coverage at the time the service was provided or subsequent to the provision of the service or item. In this case, the provider may not bill the Authority, the PHP, or third party payer for any reason, including but not limited to timeliness of claims and lack of prior authorization. The provider must document attempts to obtain information on eligibility or enrollment;

(c) The client became eligible for Authority benefits retroactively but did not meet other established criteria described in the applicable program-specific rules or contracts.

(d) The provider may document that a TPR made payments directly to the client for services provided that are subject to recovery by the provider.;

(e) The service or item is not covered under the client’s benefit package. The provider must document that prior to the delivery of services or items, the provider informed the client the service or item would not be covered by the Authority;

(f) The client requested continuation of benefits during the administrative hearing process and the final decision was not in favor of the client. The client shall be responsible for any charges since the effective date of the initial notice of denial; or

(g) In exceptional circumstances, a client may request continuation of a covered service while asserting the right to privately pay for that service. Under this circumstance, a provider may bill the client for a covered service only if the client is informed in advance of receiving the specific service of all of the following:

(A) The requested service is a covered service and the provider would be paid in full for the covered service if the claim is submitted to the Authority or the client’s PHP;

(B) The estimated cost of the covered service, including all related charges, that the Authority or PHP would pay, and for which the client is billed cannot be an amount greater than the maximum Authority or PHP reimbursable rate or PHP rate;

(C) The provider may not require the client to enter into a voluntary payment agreement for any amount for the covered service; and

(D) The provider must be able to document, in writing, signed by the client or the client’s representative, that the client was provided the information described above; was provided an opportunity to ask questions, obtain additional information, and consult with the client’s caseworker or client representative; and the client agreed to be responsible for payment by signing an agreement incorporating all of the information described above. The provider must provide a copy of the signed agreement to the client. The provider may not submit a claim for payment for the service or item to the Authority or to the client’s PHP that is subject to such an agreement.

(5) Reimbursement for Non-Covered Services.

(a) A provider may bill a client for services that are not covered by the Authority or a PHP, except as provided in these rules. The client must be informed in advance of receiving the specific service that it is not covered, the estimated cost of the service, and that the client or client’s representative is financially responsible for payment for the specific service. Providers must provide written documentation, signed by the client, or the client’s representative, dated prior to the delivery of services or item indicating that the client was provided this information and that the client knowingly and voluntarily agreed to be responsible for payment.

(b) Providers may not bill or accept payment from the Authority or a PHP for a covered service when a non-covered service has been provided and additional payment is sought or accepted from the client. Examples include but are not limited to charging the client an additional payment to obtain a gold crown (not covered) instead of the stainless steel crown (covered) or charging an additional client payment to obtain eyeglass frames not on the covered list of frames. This practice is called buying-up, which is prohibited , and a provider may be sanctioned for this practice regardless of whether a client waiver is documented.

(c) Providers may not bill clients or the Authority for a client’s missed appointment.

(d) Providers may not bill clients or the Authority for services or items provided free of charge. This limitation does not apply to established sliding fee schedules where the client is subject to the same standards as other members of the public or clients of the provider.

(e) Providers may not bill clients for services or items that have been denied due to provider error such as required documentation not submitted or prior authorization not obtained.

(6) Providers must verify that the individual receiving covered services is, in fact, an eligible client on the date of service for the service provided and that the services is covered in the client’s benefit package.

(a) Providers shall pay for costs incurred for failing to confirm eligibility or that services are covered.

(b) Providers must confirm the Authority’s client eligibility and benefit package coverage using the web portal, or the Authority telephone eligibility system, and by other methods specified in program-specific or contract instructions.

Stat. Auth.: ORS 413.042

Stats. Implemented: ORS 414.065

Hist.: OHA 14-2011(Temp), f. & cert. ef. 7-1-11 thru 12-27-11; OHA 20-2011, f. 8-30-11, cert. ef. 9-1-11

943-120-0340

Claim and PHP Encounter Submission

(1) All claims must be submitted using one of the following methods:

(a) Paper forms, using the appropriate form as described in the program-specific rules or contract;

(b) Electronically, using the web portal accessed by provider-specific PIN and password. Initial activation by provider of Authority-assigned provider number and PIN for web portal access invokes provider’s agreement to meet all of the standards for HIPAA privacy, security, and transactions and codes sets standards as defined in 45 CFR 162;

(c) Electronically in a manner authorized by the Authority’s EDT rules (OAR 943-120-0100 to 943-120-0200); or

(d) Electronically, for PHP encounters, in the manner required by the PHP contract with the Authority and authorized by the Authority’s EDT rules.

(2) Claims may not be submitted prior to delivery of service unless otherwise authorized by program-specific rules or contracts. A claim for an item may not be submitted prior to dispensing, shipping, or mailing the item unless otherwise specified in the Authority’s program-specific rules or contracts.

(3) Claims and PHP encounters must be submitted in compliance HIPAA transaction and code set rules. The HIPAA transaction and code set rules, 45 CFR 162, apply to all electronic transactions for which DHHS has adopted a standard.

(a) The Authority may deny or reject electronic transactions that fail to comply with the federal standard.

(b) The Authority shall comply with the HIPAA code set requirements in 45 CFR 162.1000 through 162.1011, regardless of whether a request is made verbally, or a claim is submitted on paper or electronically, and with regard to the electronic claims and encounter remittance advice information, including the web portal. Compliance with the code set requirements includes the codes and the descriptors of the codes established by the official entity that maintains the code set. These federal code set requirements are mandatory and the Authority may not delay or alter their application or effective dates established by DHHS.

(A) The issuance of a federal code does not mean that the Authority covers the item or service described by the federal code. When there is a variation between an Authority-listed code and a national code, the provider may seek clarification from the Authority program. The Authority shall apply the national code in effect on the date of request or date of service and the Authority-listed code may be used for the limited purpose of describing the Authority’s intent in identifying whether the applicable national code represents an Authority covered service or item.

(B) For purposes of maintaining HIPAA code set compliance, the Authority adopts by reference the required use of the version of all national code set revisions, deletions, and additions pursuant to the HIPAA transaction and code set rules in effect on the date of this rule. This code set adoption may not be construed as Authority coverage or that the existence of a particular national code constitutes a determination by the Authority that the particular code is a covered service or item. If the provider is unable to identify an appropriate procedure code to use on the claim or PHP encounter, the provider may contact the Authority for assistance in identifying an appropriate procedure code reference in but not limited to the following:

(i) Current Procedural Terminology, Fourth Edition (CPT-4), (American Medical Association);

(ii) Current Dental Terminology (CDT), (American Dental Association);

(iii) Diagnosis Related Group (DRG), (DHHS);

(iv) Health Care Financing Administration Common Procedural Coding System (HCPCS), (DHHS);

(v) National Drug Codes (NDC), (DHHS); or

(vi) HIPAA related codes, DHHS, claims adjustment reason, claim status, taxonomy codes, and decision reason available at the Washington Publishing Company web site: http://www.wpc.edi.com/content/view/180/223.

(C) For electronic claims and PHP encounters, the appropriate HIPAA claim adjustment reason code for third party payer, including Medicare, explanation of payment must be used.

(c) Diagnosis Code Requirement.

(A) For claims and PHP encounters that require the listing of a diagnosis code as the basis for the service provided, the code listed on the claim must be the code that most accurately describes the client’s condition and the service or item provided.

(B) A primary diagnosis code is required on all claims, using the HIPAA nationally required diagnosis code set including the code and the descriptor of the code by the official entity that maintains the code set, unless the requirement for a primary diagnosis code is specifically excluded in the Authority’s program-specific rules or contract. All diagnosis codes must be provided to the highest degree of specificity. Providers must use the ICD-9-CM diagnosis coding system when a diagnosis is required unless otherwise specified in the appropriate program-specific rules or contract.

(C) Hospitals must follow national coding guidelines and must bill using the 5th digit, in accordance with methodology used in the Medicare Diagnosis Related Groups.

(d) Providers must provide and identify the following procedures codes.

(A) The appropriate procedure code on claims and PHP encounters as instructed in the appropriate Authority program-specific rules or contract and must use the appropriate HIPAA procedure code set, set forth in 45 CFR 162.1000 through 162.1011, which best describes the specific service or item provided.

(B) Where there is one CPT, CDT, or HCPCS code that according to those coding guidelines or standards, describes an array of services, the provider must use that code rather than itemizing the services under multiple codes. Providers must not “unbundle” services in order to increase payment or to mischaracterize the service.

(4) No provider or its contracted agent (including billing service or billing agent) shall submit or cause to be submitted to the Authority:

(a) Any false claim for payment or false PHP encounter;

(b) Any claim or PHP encounter altered in such a way as to result in a duplicate payment for a service that has already been paid;

(c) Any claim or PHP encounter upon which payment has been made or is expected to be made by another source unless the amount paid or to be paid by the other party is clearly entered on the claim form or PHP encounter format; or

(d) Any claim or PHP encounter for providing services or items that have not been provided.

(5) Third Party Resources.

(a) A provider may not refuse to furnish covered services or items to an eligible client because of a third party’s potential liability for the service or item.

(b) Providers must take all reasonable measures to ensure that the Authority shall be the payer of last resort. If available, private insurance, Medicare, or worker’s compensation must be billed before the provider submits a claim for payment to the Authority, county, or PHP. For services provided to a Medicare and Medicaid dual eligible client, Medicare is the primary payer and the provider must first pursue Medicare payment (including appeals) prior to submitting a claim for payment to the Authority, county, or PHP. For services not covered by Medicare or other third party resource, the provider must follow the program-specific rules or contracts for appropriate billing procedures.

(c) When another party may be liable for paying the expenses of a client’s injury or illness, the provider must follow program-specific rules or contract addressing billing procedures.

(6) Full Use of Alternate Community Resources.

(a) The Authority shall generally make payment only when other resources are not available for the client’s needs. Full use must be made of reasonable alternate resources in the local community; and

(b) Providers must not accept reimbursement from more than one resource for the same service or item, except as allowed in program-specific or contract TPR requirements.

(7) Timely Submission of Claim or Encounter Data.

(a) Subsection (a) through (c) below apply only to the submission of claims data or other reimbursement document to the Authority, including provider reimbursement by the Authority pursuant to an agreement with a county. Unless requirements for timely filing provided for in program-specific rules or applicable contracts are more specific than the timely filing standard established in this rule, all claims for services or items must be submitted no later than 12 months from the date of service.

(b) A denied claim submitted within 12 months of the date of service may be resubmitted (with resubmission documentation, as indicated within the program-specific rules or contracts) within 18 months of the date of service. These claims must be submitted to the Authority in writing. The provider must present documentation acceptable to the Authority verifying the claim was originally submitted within 12 months of the date of service, unless otherwise stated in program-specific rules or contracts. Acceptable documentation is:

(A) A remittance advice or other claim denial documentation from the Authority to the provider showing the claim was submitted before the claim was one year old; or

(B) A copy of a billing record or ledger showing dates of submission to the Authority.

(c) Exceptions to the 12-month requirement that may be submitted to the Authority are as follows:

(A) When the Authority confirms the Authority or the client’s branch office has made an error that caused the provider not to be able to bill within 12 months of the date of service;

(B) When a court or an administrative law judge in a final order has ordered the Authority to make payment;

(C) When the Authority determines a client is retroactively eligible for Authority program coverage and more than 12 months have passed between the date of service and the determination of the client’s eligibility, to the extent authorized in the program-specific rules or contracts.

(d) PHP encounter data must be submitted pursuant to 45 CFR part 162.1001 and 162.1102 and the time periods established in the PHP contract with the Authority.

Stat. Auth.: ORS 413.042

Stats. Implemented: ORS 414.065

Hist.: OHA 14-2011(Temp), f. & cert. ef. 7-1-11 thru 12-27-11; OHA 20-2011, f. 8-30-11, cert. ef. 9-1-11

943-120-0350

Payments and Overpayments

(1) Payment Authorization.

(a) Some services or items covered by the Authority require authorization before a service, item, or level of care can be provided or before payment shall be made. Providers must check the appropriate program-specific rules or contracts for information on services or items requiring prior authorization and the process to follow to obtain authorization.

(b) Documentation submitted when requesting authorization must support the program-specific or contract justification for the service, item, or level of care. A request is considered complete if it contains all necessary documentation and meets any other requirements as described in the appropriate program-specific rules or contract.

(c) The authorizing program shall authorize the covered level of care, type of service, or item that meets the client’s program-eligible need. The authorizing program shall only authorize services which meet the program-specific or contract coverage criteria and for which the required documentation has been submitted. The authorizing program may request additional information from the provider to determine the appropriateness of authorizing the service, item, or level of care within the scope of program coverage.

(d) Authorizing programs may not authorize services or make payment for authorized services when:

(A) The client was not eligible at the time services were provided. The provider must check the client’s eligibility each time services are provided;

(B) The provider cannot produce appropriate documentation to support that the level of care, type of service, or item meets the program-specific or contract criteria, or the appropriate documentation was not submitted to the authorizing program;

(C) The delivery of the service, item, or level of care has not been adequately documented as described in OAR 943-120-0370. Requirements for financial, clinical and other records, and the documentation in the provider’s files is not adequate to determine the type, medical appropriateness, or quantity of services, or items provided or the required documentation is not in the provider’s files;

(D) The services or items identified in the claim are not consistent with the information submitted when authorization was requested or the services or items provided are retrospectively determined not to be authorized under the program-specific or contract criteria;

(E) The services or items identified in the claim are not consistent with those which were provided;

(F) The services or items were not provided within the timeframe specified on the authorization of services document; or

(G) The services or items were not authorized or provided in compliance with the program-specific rules or contracts.

(e) Payment made for services or items described in subsections (d)(A) through (G) of this rule shall be recovered.

(f) Retroactive Authority Client Eligibility.

(A) When a client is determined to be retroactively eligible for an Authority program, or is retroactively disenrolled from a PHP or services provided after the client was disenrolled from a PHP, authorization for payment may be given if the following conditions are met:

(i) The client was eligible on the date of service and the program-specific rules or contract authorize the Authority to reimburse the provider for services provided to clients made retroactively eligible;

(ii) The services or items provided to the client meet all other program-specific or contract criteria and Oregon Administrative Rules;

(iii) The request for authorization is received by the appropriate Authority branch or program office within 90 days of the date of service; and

(iv) The provider is enrolled with the Authority on the date of service, or becomes enrolled with the Authority no later than the date of service as provided in OAR 943-120-0320(11).

(B) Requests for authorization received after 90 days from date of service require all the documentation required in subsection (f)(A)(i), (ii) and (iv) and documentation from the provider stating why the authorization could not have been obtained within 90 days of the date of service.

(g) Service authorization is valid for the time period specified on the authorization notice, but shall not exceed 12 months, unless the client’s benefit package no longer covers the service, in which case the authorization terminates on the date coverage ended.

(h) Service authorization for clients with other insurance or for Medicare beneficiaries is governed by program-specific rules or contracts.

(2) Payments.

(a) This rule only applies to covered services and items provided to eligible clients within the program-specific or contract covered services or items in effect on the date of service that are paid for by the Authority based on program-specific or contract fee schedules or other reimbursement methods, or for services that are paid for by the Authority at the request of a county for county-authorized services.

(b) If the client’s service or item is paid for by a PHP, the provider must comply with the payment requirements established under contract with that PHP, and pursuant to OAR 410-120 and 410-141, applicable to non-participating providers.

(c) The Authority shall pay for services or items based on the reimbursement rates and methods specified in the applicable program-specific rules or contract. Provider reimbursement on behalf of a county must include county service authorization information.

(d) Providers must accept, as payment in full, the amounts paid by the Authority pursuant to the fee schedule or reimbursement method specified in the program-specific rules or contract, plus any deductible, co-payment, or coinsurance required to be paid by the client. Payment in full includes:

(A) Zero payments for claims where a third party or other resource has paid an amount equivalent to or exceeding the Authority’s allowable payment; or

(B) Denials of payment for failure to submit a claim in a timely manner, failure to obtain payment authorization in a timely and appropriate manner, or failure to follow other required procedures identified in the program-specific rules or contracts.

(e) The Authority may not make payments for duplicate services or items. The Authority may not make a separate payment or co-payment to a provider for services included in the provider’s all-inclusive rate if the provider has been or shall be reimbursed by other resources for the service or item.

(f) Payment by the Authority does not limit the Authority or any state or federal oversight entity from reviewing or auditing a claim before or after the payment. Payment may be denied or subject to recovery if medical, clinical, program-specific or contract review, audit, or other post-payment review determines the service or item was not provided in accordance with applicable rules or contracts or does not meet the program-specific or contract criteria for quality of care, or appropriateness of the care, or authorized basis for payment.

(3) Recovery of Overpayments to Providers -- Recoupments and Refunds

(a) The Authority may deny payment or may deem payments subject to recovery as an overpayment if a review or audit determines the item or service was not provided pursuant to the Authority’s rules, terms of contract, or does not meet the criteria for quality of care, or appropriateness of the care or payment. Related provider billings shall also be denied or subject to recovery.

(b) If a provider determines that a submitted claim or encounter is incorrect, the provider must submit an individual adjustment request and refund the amount of the overpayment, if any, or adjust the claim or encounter.

(c) The Authority may determine, as a result of review or other information, that a payment should be denied or that an overpayment has been made to a provider, which indicates that a provider may have submitted claims or encounters, or received payment to which the provider is not properly entitled. The payment denial or overpayment determinations may be based on but not limited to the following:

(A) The Authority paid the provider an amount in excess of the amount authorized under a contract, state plan or Authority rule;

(B) A third party paid the provider for services, or portion thereof, previously paid by the Authority;

(C) The Authority paid the provider for services, items, or drugs that the provider did not perform or provide;

(D) The Authority paid for claims submitted by a data processing agent for whom a written provider or billing agent or billing service agreement was not on file at the time of submission;

(E) The Authority paid for services and later determined they were not part of the client’s program-specific or contract-covered services;

(F) Coding, data processing submission, or data entry errors;

(G) Medical, dental, or professional review determines the service or item was not provided pursuant to the Authority’s rules or contract or does not meet the program-specific or contract criteria for coverage, quality of care, or appropriateness of the care or payment;

(H) The Authority paid the provider for services, items, or drugs when the provider did not comply with the Authority’s rules and requirements for reimbursement; or

(I) The provider submitted inaccurate, incomplete or false encounter data to the Authority.

(d) Prior to identifying an overpayment, the Authority may contact the provider requesting preliminary information and additional documentation. The provider must provide the requested documentation within the specified time frame.

(e) When an overpayment is identified, the Authority shall notify the provider in writing as to the nature of the discrepancy, the method of computing the overpayment, and any further action that the Authority may take on the matter. The notice may require the provider to submit applicable documentation for review prior to requesting an appeal from the Authority, and may impose reasonable time limits for when documentation must be provided for Authority consideration. The notice shall inform the provider of the process for appealing the overpayment determination.

(f) The Authority may recover overpayments made to a provider by direct reimbursement, offset, civil action, or other legal action:

(A) The provider must make a direct reimbursement to the Authority within 30 calendar days from the date of the notice of the overpayment, unless other regulations apply.

(B) The Authority may grant the provider an additional period of time to reimburse the Authority upon written request made within 30 calendar days from the date of the notice of overpayment. The provider must include a statement of the facts and reasons sufficient to show that repayment of the overpayment amount should be delayed pending appeal because:

(i) The provider shall suffer irreparable injury if the overpayment notice is not delayed;

(ii) There is a reason to believe that the overpayment is incorrect or is less than the amount in the notice, and the provider has timely filed an appeal of the overpayment, or that the provider accepts the amount of the overpayment but is requesting to make repayment over a period of time;

(iii) A proposed method for assuring that the amount of the overpayment can be repaid when due with interest including but not limited to a bond, irrevocable letter of credit, or other undertaking, or a repayment plan for making payments, including interest, over a period of time;

(iv) Granting the delay shall not result in substantial public harm; and

(v) Affidavits containing evidence relied upon in support of the request for stay.

(C) The Authority may consider all information in the record of the overpayment determination, including provider cooperation with timely provision of documentation, in addition to the information supplied in provider’s request. If provider requests a repayment plan, the Authority may require conditions acceptable to the Authority before agreeing to a repayment plan. The Authority must issue an order granting or denying a repayment delay request within 30 calendar days after receiving it;

(D) A request for hearing or administrative review does not change the date the repayment of the overpayment is due; and

(E) The Authority may withhold payment on pending claims and on subsequently received claims for the amount of the overpayment when overpayments are not paid as a result of paragraph (B)(i);

(f) In addition to any overpayment, the Authority may impose a sanction on the provider in connection with the actions that resulted in the overpayment. The Authority may, at its discretion, combine a notice of sanction with a notice of overpayment.

(g) Voluntary submission of an adjustment claim or encounter transaction or an individual adjustment request or overpayment amount after notice from the Authority does not prevent the Authority from issuing a notice of sanction The Authority may take such voluntary payment into account in determining the sanction.

Stat. Auth.: ORS 413.042

Stats. Implemented: ORS 414.065

Hist.: OHA 14-2011(Temp), f. & cert. ef. 7-1-11 thru 12-27-11; OHA 20-2011, f. 8-30-11, cert. ef. 9-1-11

943-120-0360

Consequences of Non-Compliance and Provider Sanctions

(1) There are two classes of provider sanctions, mandatory and discretionary, that may be imposed for non-compliance with the provider enrollment agreement.

(2) Except as otherwise provided, the Authority shall impose provider sanctions at the direction of the Authority’s division director or designee, whose budget includes payment for the services involved.

(3) Mandatory Sanctions. The Authority shall impose mandatory sanctions and suspend the provider from participation in the Authority’s programs:

(a) When a provider has been convicted (as that term is defined in 42 CFR part 1001.2) of a felony or misdemeanor related to a crime, or violation of Title XVIII, XIX, or XX of the Social Security Act or related state laws, or other disqualifying criminal conviction pursuant to program-specific rules or contract;

(b) When a provider is excluded from participation in federal or state health care programs by the Office of the Inspector General of DHHS or from the Medicare (Title XVIII) program of the Social Security Act as determined by the Secretary of DHHS. The provider shall be excluded and suspended from participation with the Authority for the duration of exclusion or suspension from the Medicare program or by the Office of the Inspector General; or

(c) If the provider fails to disclose ownership or control information required under 42 CFR part 455.104 that must be reported at the time the provider submits a provider enrollment form or when there is a material change in the information that must be reported, or information related to business transactions required to be provided under 42 CFR part 455.105 upon request of federal or state authorities.

(4) Discretionary Sanctions. When the Authority determines the provider fails to meet one or more of the Authority’s requirements governing participation in its programs the Authority may impose discretionary sanctions. Conditions that may result in a discretionary sanction include, but are not limited to when a provider has:

(a) Been convicted of fraud related to any federal, state, or locally financed health care program or committed fraud, received kickbacks, or committed other acts that are subject to criminal or civil penalties under the Medicare or Medicaid statutes;

(b) Been convicted of interfering with the investigation of health care fraud;

(c) Been convicted of unlawfully manufacturing, distributing, prescribing, or dispensing a controlled substance or other potentially disqualifying crime, as determined under program-specific rules or contracts;

(d) By actions of any state licensing authority for reasons relating to the provider’s professional competence, professional conduct, or financial integrity either:

(A) Had the professional license suspended or revoked, or otherwise lost such license; or

(B) Surrendered the license while a formal disciplinary proceeding is pending before the relevant licensing authority.

(e) Been suspended or excluded from participation in any federal or state program for reasons related to professional competence, professional performance, or other reason;

(f) Billed excessive charges including but not limited to charging in excess of the usual charge, furnished items or services in excess of the client’s needs or in excess of those services ordered by a provider, or in excess of generally accepted standards or quality that fail to meet professionally recognized standards;

(g) Failed to furnish necessary covered services as required by law or contract with the Authority if the failure has adversely affected or has a substantial likelihood of adversely affecting the client;

(h) Failed to disclose required ownership information;

(i) Failed to supply requested information on subcontractors and suppliers of goods or services;

(j) Failed to supply requested payment information;

(k) Failed to grant access or to furnish as requested, records, or grant access to facilities upon request of the Authority or the MFCU conducting their regulatory or statutory functions;

(l) In the case of a hospital, failed to take corrective action as required by the Authority, based on information supplied by the QIO to prevent or correct inappropriate admissions or practice patterns, within the time specified by the Authority;

(m) In the case of a licensed facility, failed to take corrective action under the license as required by the Authority within the time specified by the Authority;

(n) Defaulted on repayment of federal or state government scholarship obligations or loans in connection with the provider’s health profession education;

(A) Providers must have made a reasonable effort to secure payment;

(B) The Authority must take into account access of beneficiaries to services; and

(C) Shall not exclude a community’s sole physician or source of essential specialized services;

(o) Repeatedly submitted a claim with required data missing or incorrect:

(A) When the missing or incorrect data has allowed the provider to:

(i) Obtain greater payment than is appropriate;

(ii) Circumvent prior authorization requirements;

(iii) Charge more than the provider’s usual charge to the general public;

(iv) Receive payments for services provided to individuals who were not eligible; or

(v) Establish multiple claims using procedure codes that overstate or misrepresent the level, amount, or type of services or items provided.

(B) Does not comply with the requirements of OAR 410-120-1280.

(p) Failed to develop, maintain, and retain, pursuant to relevant rules and standards, adequate clinical or other records that document the client’s eligibility and coverage, authorization (if required by program-specific rules or contracts), appropriateness, nature, and extent of the services or items provided;

(q) Failed to develop, maintain, and retain pursuant to relevant rules and standards, adequate financial records that document charges incurred by a client and payments received from any source;

(r) Failed to develop, maintain, and retain adequate financial or other records that support information submitted on a cost report;

(s) Failed to follow generally accepted accounting principles or accounting standards or cost principles required by federal or state laws, rules, or regulations;

(t) Submitted claims or written orders contrary to generally accepted standards of professional practice;

(u) Submitted claims for services that exceed the requested or agreed upon amount by the OHP client, the client representative, or requested by another qualified provider;

(v) Breached the terms of the provider contract or agreement;

(w) Failed to comply with the terms of the provider certifications on the claim form;

(x) Rebated or accepted a fee or portion of a fee for a client referral; or collected a portion of a service fee from the client and billed the Authority for the same service;

(y) Submitted false or fraudulent information when applying for an Authority-assigned provider number, or failed to disclose information requested on the provider enrollment form;

(z) Failed to correct deficiencies in operations after receiving written notice of the deficiencies from the Authority;

(aa) Submitted any claim for payment for which the Authority has already made payment or any other source unless the amount of the payment from the other source is clearly identified;

(bb) Threatened, intimidated, or harassed clients, client representatives, or client relatives in an attempt to influence payment rates or affect the outcome of disputes between the provider and the Authority;

(cc) Failed to properly account for a client’s personal incidental funds including but not limited to using a client’s personal incidental funds for payment of services which are included in a medical facility’s all-inclusive rates;

(dd) Provided or billed for services provided by ineligible or unsupervised staff;

(ee) Participated in collusion that resulted in an inappropriate money flow between the parties involved;

(ff) Refused or failed to repay, in accordance with an accepted schedule, an overpayment established by the Authority;

(gg) Failed to report to Authority payments received from any other source after the Authority has made payment for the service; or

(hh) Collected or made repeated attempts to collect payment from clients for services covered by the Authority, under OAR 410-120-1280.

(5) A provider who has been excluded, suspended, or terminated from participation in a federal or state medical program, such as Medicare or Medicaid, or whose license to practice has been suspended or revoked by a state licensing board, may not submit claims for payment, either personally or through claims submitted by any billing agent or service, billing provider or other provider, for any services or supplies provided under the medical assistance programs, except those services or supplies provided prior to the date of exclusion, suspension or termination.

(6) Providers may not submit claims for payment to the Authority for any services or supplies provided by an individual or provider entity that has been excluded, suspended, or terminated from participation in a federal or state medical program, such as Medicare or Medicaid, or whose license to practice has been suspended or revoked by a state licensing board, except for those services or supplies provided prior to the date of exclusion, suspension or termination.

(7) When the provisions of sections (5) or (6) are violated, the Authority may suspend or terminate the billing provider or any provider who is responsible for the violation.

(8) Sanction Types and Conditions.

(a) A mandatory sanction imposed by the Authority pursuant to section (3) may result in any of the following:

(A) The provider shall either be terminated or suspended from participation in the Authority’s programs. No payments of Title XIX, Title XXI or other federal or state funds shall be made for services provided after the date of termination. Termination is permanent unless:

(i) The exceptions cited in 42 CFR part 1001.221 are met; or

(ii) Otherwise stated by the Authority at the time of termination.

(B) No payments of Title XIX, Title XXI, or other federal or state funds shall be made for services provided during the suspension. The Authority shall automatically reactivate the provider number y after the suspension period has elapsed if the conditions that caused the suspension have been resolved. The minimum duration of a suspension shall be determined by the DHHS Secretary, under the provisions of 42 CFR parts 420, 455, 1001, or 1002. The Authority may suspend a provider from participation in the medical assistance programs longer than the minimum suspension determined by the DHHS secretary.

(b) The Authority may impose the following discretionary sanctions on a provider pursuant to OAR 410-120-1400(4):

(A) The provider may be terminated from participation in the Authority’s programs. No payments of Title XIX, Title XXI or other federal or state funds shall be made for services provided after the date of termination. Termination is permanent unless:

(i) The exceptions cited in 42 CFR part 1001.221 are met; or

(ii) Otherwise stated by the Authority at the time of termination.

(B) The provider may be suspended from participation in the Authority’s programs for a specified length of time, or until specified conditions for reinstatement are met and approved by the Authority. No payments of Title XIX, Title XXI, or other federal or state funds shall be made for services provided during the suspension. The Authority shall automatically reactivate the provider number after the suspension period has elapsed if the conditions that caused the suspension have been resolved.

(C) The Authority may withhold payments to a provider;

(D) The provider may be required to attend provider education sessions at the expense of the sanctioned provider;

(E) The Authority may require that payment for certain services are made only after the Authority has reviewed documentation supporting the services;

(F) The Authority may require repayment of amounts paid or provide for reduction of any amount otherwise due the provider; and

(G) Any other sanctions reasonably designed to remedy or compel future compliances with federal, state, or Authority regulations.

(c) The Authority shall consider the following factors in determining the sanction to be imposed. Factors include but are not limited to:

(A) Seriousness of the offense;

(B) Extent of violations by the provider;

(C) History of prior violations by the provider;

(D) Prior imposition of sanctions;

(E) Prior provider education;

(F) Provider willingness to comply with program rules;

(G) Actions taken or recommended by licensing boards or a QIO;

(H) Adverse impact on the availability of program-specific or contract covered services or the health of clients living in the provider’s service area; and

(I) Potential financial sanctions related to the non-compliance may be imposed in an amount that is reasonable in light of the anticipated or actual harm caused by the non-compliance, the difficulties of proof of loss, and the inconvenience or non-feasibility of otherwise obtaining an adequate remedy.

(d) When a provider fails to meet one or more of the requirements identified in OAR 943-120-0300 through 943-120-0400, the Authority, in its sole discretion, may immediately suspend the provider’s Authority assigned billing number and any electronic system access code to prevent public harm or inappropriate expenditure of public funds.

(A) The provider subject to immediate suspension is entitled to a contested case hearing pursuant to ORS 183 to determine whether the provider’s Authority assigned number and electronic system access code may be revoked; and

(B) The notice requirements described in section (5) of this rule do not preclude immediate suspension, in the Authority’s sole discretion, to prevent public harm or inappropriate expenditure of public funds. Suspension may be invoked immediately while the notice and contested case hearing rights are exercised.

(e) If the Authority sanctions a provider, the Authority shall notify the provider by certified mail or personal delivery service of the intent to sanction. The notice of immediate or proposed sanction shall identify:

(A) The factual basis used to determine the alleged deficiencies and a reference to the particular sections of the statutes and rules involved;

(B) Explanation of actions expected of the provider;

(C) Explanation of the Authority’s intended action;

(D) The provider’s right to dispute the Authority’s allegations and submit evidence to support the provider’s position;

(E) The provider’s right to appeal the Authority’s proposed actions pursuant to ORS 183;

(F) A statement of the authority and jurisdiction under which the appeal may be requested and description of the procedure and time to request an appeal; and

(G) A statement indicating whether and under what circumstances an order by default may be entered.

(f) If the Authority decides to sanction a provider, the Authority shall notify the provider in writing at least 15 days before the effective date of action, except in the case of immediate suspension to avoid public harm or inappropriate expenditure of funds.

(g) The provider may appeal the Authority’s immediate or proposed sanction or other actions the Authority intends to take. The provider must appeal this action separately from any appeal of audit findings and overpayments. These include but are not limited to the following:

(A) Termination or suspension from participation in the Medicaid-funded medical assistance programs;

(B) Termination or suspension from participation in the Authority’s state-funded programs; or

(C) Revocation of the provider’s Authority assigned provider number.

(h) Other provisions:

(A) When a provider has been sanctioned, all other provider entities in which the provider has ownership of five percent or greater, or control of, may also be sanctioned;

(B) When a provider has been sanctioned, the Authority may notify the applicable professional society, board of registration or licensure, federal or state agencies, OHP, PHP’s, and the National Practitioner Data Base of the findings and the sanctions imposed;

(C) At the discretion of the Authority, providers who have previously been sanctioned or suspended may or may not be re-enrolled as Authority providers;

(D) Nothing in this rule prevents the Authority from simultaneously seeking monetary recovery and imposing sanctions against the provider;

(E) Following a contested case hearing in which a provider has been found to violate ORS 411.675, the provider shall be liable to the Authority for treble the amount of payments received as a result of each violation.

Stat. Auth.: ORS 413.042

Stats. Implemented: ORS 414.065

Hist.: OHA 14-2011(Temp), f. & cert. ef. 7-1-11 thru 12-27-11; OHA 20-2011, f. 8-30-11, cert. ef. 9-1-11

943-120-0370

Requirements for Financial, Clinical, and Other Records

(1) The Authority shall analyze and monitor the operation of its programs and audit and verify the accuracy and appropriateness of payment, utilization of services, or items.

(2) The Authority shall comply with client coverage criteria and requirements for the level of care or service or item authorized or reimbursed by the Authority and the quality of covered services or items and service or item delivery, and access to covered services or items.

(3) The provider and the provider’s designated billing service or other entity responsible for the maintenance of financial, service delivery, and other records must:

(a) Develop and maintain adequate financial and service delivery records and other documentation which supports the specific care, items, or services for which payment has been requested. The Authority may not make payment for services that are not adequately documented. The following documentation must be completed before the service is billed to the Authority:

(A) All records documenting the specific service provided, the number of services or items comprising the service provided, the extent of the service provided, the dates on which the service was provided, and identification of the individual who provided the service. Patient account and financial records must also include documentation of charges, identify other payment resources pursued, indicate the date and amount of all debit or credit billing actions, and support the appropriateness of the amount billed and paid. For cost reimbursed services, the provider must maintain adequate records to thoroughly and accurately explain how the amounts reported on the cost statement were determined.

(B) Service delivery, clinical records, and visit data, including records of all therapeutic services, must document the basis for service delivery and record visit data if required under program-specific rules or contracts. A client’s clinical record must be annotated each time a service is provided and signed or initialed by the individual providing the service or must clearly identify the individual providing the service. Information contained in the record must be sufficient in quality and quantity to meet the professional standards applicable to the provider or practitioner and any additional standards for documentation found in this rule, program-specific rules, and any pertinent contracts.

(C) All information about a client obtained by the provider or its officers, employees, or agents in the performance of covered services, including information obtained in the course of determining eligibility, seeking authorization, and providing services, is confidential. The client information must be used and disclosed only to the extent necessary to perform these functions.

(b) Implement policies and procedures to ensure confidentiality and security of the client’s information. These procedures must ensure the provider may release such information pursuant to program-specific federal and state statutes or contract, which may include but is not limited to, ORS 179.505 to 179.507, 411.320, 433.045, 42 CFR part 2, 42 CFR part 431 subpart F, 45 CFR 205.50, and ORS 433.045(3) with respect to HIV test information.

(c) Ensure the use of electronic record-keeping systems does not alter the requirements of this rule.

(A) A provider’s electronic record-keeping system includes electronic transactions governed by HIPAA transaction and code set requirements and records, documents, documentation, and information include all information, whether maintained or stored in electronic media, including electronic record-keeping systems, and information stored or backed up in an electronic medium.

(B) If a provider maintains financial or clinical records electronically, the provider must be able to provide the Authority with hard-copy versions. The provider must also be able to provide an auditable means of demonstrating the date the record was created and the identity of the creator of a record, the date the record was modified, what was changed in the record and the identity of any individual who has modified the record. The provider must supply the information to individuals authorized to review the provider’s records under subsection (e) of this rule.

(C) Providers may comply with the documentation review requirements in this rule by providing the electronic record in an electronic format acceptable to an authorized reviewer. The authorized reviewer must agree to receive the documentation electronically.

(d) Retain service delivery, visit, and clinical records for seven years and all other records described in this rule, program-specific rules and contract for at least five years from the date of service.

(e) Furnish requested documentation (including electronically recorded information or information stored or backed up in an electronic medium) immediately or within the time-frame specified in the written request received from the Authority, the Oregon Secretary of State, DHHS or other federal funding agency, Office of Inspector General, the Comptroller General of the United States (for federally funded programs), MFCU (for Medicaid-funded services or items), or the client representative. Copies of the documents may be furnished unless the originals are requested. At their discretion, official representatives of the Authority, Medicaid Fraud Unit, DHHS, or other authorized reviewers may review and copy the original documentation in the provider’s place of business. Upon written request of the provider, the program or the unit, may, at its sole discretion, modify or extend the time for provision of such records if, in the opinion of the program or unit good cause for such extension is shown. Factors used in determining if good cause exists include:

(A) Whether the written request was made prior to the deadline for production;

(B) If the written request is made after the deadline for production, the amount of time lapsed since that deadline;

(C) The efforts already made to comply with the request;

(D) The reasons the deadline cannot be met;

(E) The degree of control that the provider had over its ability to produce the records prior to the deadline; and

(F) Other extenuating factors.

(f) Except as otherwise provided access to records, inclusive of clinical charts and financial records does not require authorization or release from the client, if the purpose of the access is:

(A) To perform billing review activities;

(B) To perform utilization review activities;

(C) To review quality, quantity, medical appropriateness of care, items, and services provided;

(D) To facilitate service authorization and related services;

(E) To investigate a client’s hearing request;

(F) To facilitate investigation by the MFCU or DHHS; or

(G) To review records necessary to the operation of the program.

(g) Failure to comply with requests for documents within the specified time-frame means that the records subject to the request may be deemed by the Authority not to exist for purposes of verifying appropriateness of payment, clinical appropriateness, the quality of care, and the access to care in an audit or overpayment determination, and subjects the provider to possible denial or recovery of payments made by the Authority or to sanctions.

Stat. Auth.: ORS 413.042

Stats. Implemented: ORS 414.065

Hist.: OHA 14-2011(Temp), f. & cert. ef. 7-1-11 thru 12-27-11; OHA 20-2011, f. 8-30-11, cert. ef. 9-1-11

943-120-0380

Fraud and Abuse

(1) Providers shall promptly refer all suspected fraud and abuse, including fraud or abuse by its employees or in Authority administration, to the MFCU, or to the Authority’s audit unit.

(2) Providers must permit the MFCU and the Authority to inspect, copy, evaluate, or audit books, records, documents, files, accounts, and facilities, without charge, as required to investigate allegations or incidents of fraud or abuse.

(3) Providers aware of suspected fraud or abuse by a client must report the incident to the Authority’s fraud unit.

(4) The Authority may share information for health oversight purposes with the MFCU and other federal or state health oversight authorities.

(5) The Authority may take actions necessary to investigate and respond to substantiated allegations of fraud and abuse including but not limited to suspending or terminating the provider from participation in the Authority’s programs, withholding payments or seeking recovery of payments made to the provider, or imposing other sanctions provided under state law or regulations. Such actions by the Authority may be reported to CMS or other federal or state entities as appropriate.

Stat. Auth.: ORS 413.042

Stats. Implemented: ORS 414.065

Hist.: OHA 14-2011(Temp), f. & cert. ef. 7-1-11 thru 12-27-11; OHA 20-2011, f. 8-30-11, cert. ef. 9-1-11

943-120-0400

MMIS Replacement Communication Plan

(1) The purpose of this rule is to describe the Authority’s plan for communicating instructions and guidance related to the Authority’s implementation of the replacement MMIS that began on December 9, 2008. System issues are anticipated to be identified for a period of time during and after implementation. This rule is adopted to be effective retroactively to December 9, 2008 for the purpose of providing continuity of all MMIS communication efforts throughout the transition implementation process and regular operations following the transition. By adopting this communication plan in rule, the Authority seeks to assure that eligible Authority clients receive all necessary and appropriate services, and that Authority providers and PHPs are correctly reimbursed for covered services provided to eligible clients.

(2) To the extent necessary to accomplish the purposes of this rule, the Authority shall provide guidance and instructions related to MMIS for providers and PHPs using its web site and MMIS provider announcements.

(a) In cases of limitations or system errors in the replacement MMIS, the Authority shall provide update information and important action required in concert with, or in place of, normal established procedures.

(b) In other cases, the Authority shall provide instructions and guidance about the use of revised or improved functionality that is available through the replacement MMIS, such as the use of the web portal.

(3) Providers and PHPs must follow all applicable instructions given on the Authority’s web page and any provider announcements for the dates specifically noted in the communications, or if a date is not specified, until further instructions are provided. Authority web site information and links to specific topics may be accessed at: http://www.oregon.gov/DHS/
healthplan/tools_prov/main.shtml.

(4) This rule does not amend existing rules or contracts that require providers or PHPs to confirm eligibility, respond to requests for prior authorization, submit claims or encounter data, or comply with any other rule or contract that imposes obligations on a provider or PHP as a condition of receiving reimbursement for services. This rule is intended to provide assurance to providers and PHPs that the MMIS-related processes for meeting those obligations are being addressed by the Authority by providing guidance and instruction related to the provider’s or PHP’s interface with MMIS processes, and by identifying the resources providers and PHPs may use to obtain information during this time of transition to the replacement MMIS and during regular MMIS operations.

(5) The Authority shall work with providers and PHPs by providing instructions and guidance to assure that service delivery and reimbursement disruptions related to transition to the replacement MMIS are minimized. Providers and PHPs must appropriately document all eligibility, services, authorization, claims, and payment information during the transition time, and their efforts to comply with instructions and guidance provided by the Authority, so that reimbursement may be correctly provided.

(6) Providers and PHPs must immediately communicate to the Authority any issues they encounter that are not addressed in the Authority’s instructions or guidance in seeking eligibility information or activities related to reimbursement for services through MMIS, errors discovered in the correct amount of any reimbursement received for those services, or in applying the instruction or guidance to resolve an issue.

(7) After the transition period is complete, the Authority shall continue to implement this communication plan as long as necessary during regular MMIS operations in order to assist providers and PHPs with technical and system requirements of the replacement MMIS.

Stat. Auth.: ORS 413.042

Stats. Implemented: ORS 414.065

Hist.: OHA 14-2011(Temp), f. & cert. ef. 7-1-11 thru 12-27-11; OHA 20-2011, f. 8-30-11, cert. ef. 9-1-11

 

Rule Caption: Audits and Overpayment Recovery for Providers and Contractors receiving payments from or through the Authority

Adm. Order No.: OHA 21-2011

Filed with Sec. of State: 8-31-2011

Certified to be Effective: 9-1-11

Notice Publication Date: 8-1-2011

Rules Adopted: 943-120-1505

Rules Repealed: 943-120-1505(T)

Subject: These rules adopt and incorporate by reference the Department of Human Services’ Audits and Overpayment Recovery rule: chapter 407-120-1505. Providers or contractors receiving payments from or through the Oregon Health Authority are subject to audit or other post payment review procedures for all payments applicable to items or services furnished or supplied by the provider or contractor to or on behalf of the Authority or to its clients.

      HB 2009 created the Oregon Health Authority and transferred to the Authority the Department of Human Services’ Divisions with respect to health and health care. Effective July 1, 2011 the Authority will no longer be able to rely on the Department of Human Services’ general rules found in OAR chapter 407. The Authority is adopting and incorporating by reference the Department’s rule which provide the Authority with the legal authority to conduct audits and overpayment recovery with respect to providers or contractors receiving payments from the Authority.

Rules Coordinator: Evonne Alderete—(503) 932-9663

943-120-1505

Audits and Overpayment Recovery

Providers or contractors receiving payments from or through the Oregon Health Authority are subject to audit or other post payment review procedures for all payments applicable to items or services furnished or supplied by the provider or contractor to or on behalf of the Authority or to its clients.

(1) The Authority adopts and incorporates by reference the rules established in OAR 407-120-1505, for those matters that involve providers or contractors of the Authority, except as otherwise provided in this rule. Audit rules and procedures from OAR 407-120-1505 as incorporated into this rule ensure proper payments were made by the Authority based on requirements applicable to covered services and promote program integrity.

(2) Any reference to OAR 407-120-1505 in rules or contracts of the Authority are deemed to be references to the requirements of this rule, and shall be construed to apply to providers or contractors receiving payments from or through the Authority.

(3) The Authority authorizes the Department to act on its behalf in carrying out audits and establishing overpayment amounts associated with the administration of programs or activities administered by the Authority.

(4) Provider appeals for the Authority shall be handled by the Authority under the procedures set forth in OAR 407-120-1505. References to “the OPAR Administrator” or “the Administrator” are hereby incorporated as references to “the Authority Director.”

[Publication: Publications referenced are available from the agency.]

Stat. Auth.: ORS 413.042 & 2009 OL Ch. 595, § 9–25

Stats. Implemented: ORS 411.010, 413.032, 414.065 & 414.715

Hist.: OHA 15-2011(Temp), f. & cert. ef. 7-1-11 thru 12-27-11; OHA 21-2011, f. 8-31-11, cert. ef. 9-1-11

 

Rule Caption: Privacy OARs setting forth general procedures governing the collection, use and disclosure of protected information.

Adm. Order No.: OHA 22-2011

Filed with Sec. of State: 9-2-2011

Certified to be Effective: 9-2-11

Notice Publication Date: 8-1-2011

Rules Adopted: 943-014-0000, 943-014-0010, 943-014-0015, 943-014-0020, 943-014-0030, 943-014-0040, 943-014-0050, 943-014-0060, 943-014-0070

Rules Repealed: 943-014-0000(T), 943-014-0010(T), 943-014-0015(T), 943-014-0020(T), 943-014-0030(T), 943-014-0040(T), 943-014-0050(T), 943-014-0060(T), 943-014-0070(T)

Subject: These rules govern the collection, use, and disclosure of protected information by the Authority about individuals and to explain the rights and specific actions that individuals may take or request to be taken regarding the uses and disclosures of their protected information. These rules also set forth Authority requirements governing the use and disclosure of protected health information for purposes of HIPAA, 42 USC 1320-d through 1320d-8, Pub L 104-191, sec. 262 and 264, and the implementing HIPAA privacy rules, 45 CFR parts 160 and 164.

Rules Coordinator: Evonne Alderete—(503) 932-9663

943-014-0000

Definitions

The following definitions apply to OAR 943-014-0000 to 943-014-0070:

(1) “Administrative Hearing” means an oral proceeding before an administrative law judge in a contested case hearing.

(2) “Authority” means the Oregon Health Authority.

(3) “Authority Workforce” means employees, volunteers, trainees, and other persons whose conduct, in the performance of work for the Authority, is under the direction and control of the Authority, whether or not they are paid by the Authority.

(4) “Authorization” means permission from an individual or his or her personal representative giving the Authority , and others named on the form, authorization to obtain, release or use information about the individual from third parties for specified purposes or to disclose information to a third party specified by the individual.

(5) “Business Associate” means an individual or entity performing any function or activity on behalf of the Authority involving the use or disclosure of protected health information (PHI) and is not a member of the Authority’s workforce.

(a) “Function or activity” includes but is not limited to program administration, claims processing or administration, data analysis, utilization review, quality assurance, billing, legal, actuarial, accounting, consulting, data processing, management, administrative, accreditation, financial services, and similar services for which the Authority may contract or obtain by interagency agreement, if access to PHI is involved.

(b) Business associates do not include licensees or providers unless the licensee or provider also performs some function or activity on behalf of the Authority.

(6) “Client” means an individual who requests or receives program benefits or direct services from the Authority, including but not limited to services requested in connection with the administration of the medical assistance program, and individuals who apply for or are admitted to a state hospital or who are committed to the custody of the Authority,

(7) “Client Information” means personal information relating to a client that the Authority may maintain in one or more locations and in various forms, reports, or documents, or stored or transmitted by electronic media.

(8) “Collect” or “Collection” means the assembling of personal information through interviews, forms, reports, or other information sources.

(9) “Contract” means a written agreement between the Authority and a person or entity setting forth the rights and obligations of the parties including but not limited to contracts, licenses, agreements, interagency agreements, and intergovernmental agreements.

(10) “Correctional Institution” means any penal or correctional facility, jail, reformatory, detention center, work farm, halfway house, or residential community program center operated by contract with the federal government, a state, or an Indian tribe for the confinement or rehabilitation of persons charged with or convicted of a criminal offense or other persons held in lawful custody. “Other persons held in lawful custody” include juvenile offenders, adjudicated delinquents, aliens detained awaiting deportation, witnesses, or others awaiting charges or trial.

(11) “Corrective Action” means an action that a business associate must take to remedy a breach or violation of the business associate’s obligations under the business associate’s contractual requirement, including but not limited to reasonable steps that must be taken to cure the breach or end the violation.

(12) “Covered Entity” means health plans, health care clearinghouses, and health care providers who transmit any health information in electronic form in connection with a transaction that is subject to federal Health Insurance Portability and Accountability Act (HIPAA) requirements, as those terms are defined and used in the HIPAA regulations, 45 CFR parts 160 and 164.

(13) “De-identified Data” means client information from which the Authority or other entity has deleted, redacted, or blocked identifiers so the remaining information cannot reasonably be used to identify an individual.

(14) “Department” means the Department of Human Services.

(15) “Disclose” means the release, transfer, relay, provision of access to, or conveying of client information to any individual or entity outside the Authority.

(16) “Health Care” means care, services, or supplies related to the health of an individual. Health care includes but is not limited to preventive, diagnostic, therapeutic, rehabilitative, maintenance, palliative care, counseling services, assessment, or procedures with respect to the physical or mental condition, or functional status of an individual, or that affects the structure or function of the body and the sale or dispensing of a drug, device, equipment, or other prescribed item.

(17) “Health Care Operations” means any activities of the Authority to the extent that the activities are related to health care, Medicaid, or any other health care related programs, services, or activities administered by the Authority and include:

(a) Conducting quality assessment and improvement activities, including income evaluation and development of clinical guidelines;

(b) Population-based activities related to improving health or reducing health care costs, protocol development, case management and care coordination, contacting health care providers and patients with information about treatment alternatives; and related functions that do not include treatment;

(c) Reviewing the competence of qualifications of health care professionals, evaluating practitioner, provider, and health plan performance; and conducting training programs in which students and trainees in areas of health care learn under supervision to practice or improve their skills, accreditation, certification, licensing, or credentialing activities;

(d) Underwriting, premium rating, and other activities relating to the creation, renewal, or replacement of a contract for Medicaid or health care related services;

(e) Conducting or arranging for medical review, legal services, and auditing functions, including fraud and abuse detection and compliance programs, and disclosure to the Medicaid Fraud Unit pursuant to 43 CFR part 455.21;

(f) Business planning and development, such as conducting cost-management and planning-related analyses related to managing and operating the Authority, including administration, development, or improvement of methods of payments or health care coverage; and

(g) Business management and general administrative activities of the Authority, including but not limited to:

(A) Management activities relating to implementation of and compliance with the requirements of HIPAA;

(B) Customer service, including providing data analysis;

(C) Resolution of internal grievances, including administrative hearings and the resolution of disputes from patients or enrollees regarding the quality of care and eligibility for services; and

(D) Creating de-identified data or a limited data set.

(18) “Health Oversight Agency” means an agency or authority of the federal government, a state, territory, political subdivision of a state or territory, Indian tribe, or a person or entity acting under a grant of authority from or by contract with the public agency, including employees or agents of the public agency or its contractors or grantees that is authorized by law to oversee the health care system or government programs in which health information is necessary to determine eligibility or compliance, or to enforce civil rights laws for which health information is relevant. When performing these functions, the Authority acts as a health oversight agency for the purposes of these rules.

(19) “HIPAA” means the Title II, Subtitle F of the Health Insurance Portability and Accountability Act of 1996, 42 USC 1320d et seq, and the federal regulations adopted to implement the Act.

(20) “Individual” means the person who is the subject of information collected, used, or disclosed by the Authority.

(21) “Individually Identifying Information” means any single item or compilation of information or data that indicates or reveals the identity of an individual, either specifically (such as the individual’s name or social security number), or from which the individual’s identity can be reasonably ascertained.

(22) “Information” means personal information relating to an individual, a participant, or an Authority client.

(23) “Inmate” means a person incarcerated in or otherwise confined in a correctional institution. An individual is no longer an inmate when released on parole, probation, supervised release, or is otherwise no longer in custody.

(24) “Institutional Review Board (IRB)” means a specially constituted review body established or designated by an entity in accordance with 45 CFR part 46 to protect the welfare of human subjects recruited to participate in biomedical or behavioral research. The IRB must be registered with the Office for Human Research Protection.

(25) “Law Enforcement Official” means an officer or employee of any agency or authority of the federal government, a state, territory, political subdivision of a state or territory, or Indian tribe who is empowered by law to:

(a) Investigate and conduct an official inquiry into a potential violation of law; or

(b) Prosecute or otherwise conduct a criminal, civil, or administrative proceeding arising from an alleged violation of law.

(26) “Licensee” means a person or entity that applies for or receives a license, certificate, registration, or similar authority from the Authority to perform or conduct a service, activity, or function.

(27) “Minimum Necessary” means the least amount of information, when using or disclosing confidential client information, that is needed to accomplish the intended purpose of the use, disclosure, or request.

(28) “Participant” means individual’s participating in Authority population-based services, programs, and activities that serve the general population, but who do not receive program benefits or direct services received by a client. Examples of participants include but are not limited to an individual whose birth certificate is recorded with Department of Vital Statistics, the subjects of public health studies, immunization or cancer registries, newborn screening, and other public health services, and individuals who contact Authority hotlines or the ombudsman for general public information services.

(29) “Payment” means any activities undertaken by the Authority related to a client to whom health care is provided in order to:

(a) Obtain premiums or to determine or fulfill its responsibility for coverage and provision of benefits under the Medicaid program or other publicly funded health care services; and

(b) Obtain or provide reimbursement for the provision of health care.

(30) Payment activities mean:

(a) Determinations of eligibility or coverage, including coordination of benefits or the determination of cost sharing amounts, and adjudication of health benefit or health care claims;

(b) Risk adjusting amounts due which are based on enrollee health status and demographic characteristics;

(c) Billing, claims management, collection activities, obtaining payment under a contract for reinsurance, and related health care data processing;

(d) Review of health care services with respect to medical necessity, coverage under a health plan, appropriateness of care, or justification of charges;

(e) Utilization review activities, including pre-certification and pre-authorization of services, concurrent and retrospective review of services; and

(f) Disclosure to consumer reporting agencies relating to collection of premiums or reimbursement including name and address, date of birth, payment history, account number, and name and address of the health care provider or health plan.

(31) “Personal Representative” means a person who has authority to act on behalf of an individual in making decisions related to health care.

(32) “Protected Health Information (PHI)” means any individually identifiable health information, whether oral or recorded in any form or medium, that is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse and relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual. Any data transmitted or maintained in any other form or medium by covered entities, including paper records, fax documents, all oral communications, or any other form, such as screen prints of eligibility information, printed e-mails containing identified individual’s health information, claim or billing information, or hard copy birth or death certificates. PHI does not include school records that are subject to the Family Educational Rights and Privacy Act and employment records held in the Authority’s role as an employer.

(33) “Protected Information” means any participant or client information that the Authority may have in its records or files that must be safeguarded pursuant to Authority policy. This includes but is not limited to individually identifying information.

(34) “Provider” means a person or entity that may seek reimbursement from the Authority as a provider of services to Authority clients pursuant to a contract. For purposes of these rules, reimbursement may be requested on the basis of claims or encounters or other means of requesting payment.

(35) “Psychotherapy Notes” mean notes recorded in any medium by a health care provider who is a mental health professional documenting or analyzing the contents of conversations during a private counseling session, or group, joint, or family counseling session, when the notes are separated from the rest of the individual’s record. Psychotherapy notes do not include medication prescription and monitoring, counseling session start and stop times, the modalities and frequencies of treatment furnished, results of clinical tests, and any summary of diagnosis, functional status, treatment plan, symptoms, prognosis, or progress to date.

(36) “Public Health Agency” means a public agency, including the Authority, or a person or entity acting under a grant of authority from or by contract with the Authority or public agency that performs or conducts one or more of the following essential functions that characterize public health programs, services, or activities:

(a) Monitor health status to identify community health problems;

(b) Diagnose and investigate health problems and health hazards in the community;

(A) Inform, educate, and empower people about health issues;

(B) Mobilize community partnerships to identify and solve health problems;

(C) Develop policies and plans that support individual and community health efforts;

(D) Enforce laws and regulations that protect health and ensure safety;

(E) Direct individuals to needed personal health services and assure the provision of health care when otherwise unavailable;

(F) Ensure a competent public health and personal health care workforce;

(G) Evaluate the effectiveness, accessibility, and quality of personal and population-based health services; and

(H) Perform research for new insights and innovative solutions to health problems.

(37) “Public Health Authority” means an agency or authority of the federal government, a state, territory, political subdivision of a state or territory, Indian tribe, or a person or entity acting under a grant of authority from or by contract with the public agency, including the employees or agents of the public agency, or its contractors or persons or entities to whom it has granted authority, that is responsible for public health matters as part of its official mandate. When performing functions as a public health agency, the Authority acts as a public health authority for purposes of these rules.

(38) “Re-disclosure” means the disclosure of information to a person, an Authority program, an Authority subcontracted entity, or other entity or person other than what was originally authorized.

(39) “Research” means systematic investigation, including research development, testing, and evaluation, designed to develop or contribute to generalized knowledge.

(40) “Required by Law” means a duty or responsibility that federal or state law specifies that a person or entity must perform or exercise. Required by law includes but is not limited to court orders and court-ordered warrants; subpoenas or summons issued by a court, grand jury, a governmental or tribal inspector general, or an administrative body authorized to require the production of information; a civil or an authorized investigative demand; Medicare conditions of participation with respect to health care providers participating in the program; and statutes or rules that require the production of information, including statutes or rules that require such information if payment is sought under a government program providing public benefits.

(41) “Treatment” means the provision, coordination, or management of heath care and related services by one or more health care providers, including the coordination or management of health care by a health care provider with a third party, consultation between health care providers relating to a patient, or the referral of a patient for health care from one health care provider to another.

(42) “Use” means the sharing of individual information within an Authority program or the sharing of individual information between program staff and administrative staff that support or oversee the program.

Stat. Auth.: ORS 413.042

Stats. Implemented: ORS 179.505, 192.518 – 192.529, 411.010, 413.032 & 414.065

Hist.: OHA 8-2011(Temp), f. & cert. ef. 7-1-11 thru 12-27-11; OHA 22-2011, f. & cert. ef. 9-2-11

943-014-0010

Purpose

(1) The purpose of these rules (OAR 943-014-000 to 943-014-0070) is to govern the collection, use, and disclosure of protected information by the Authority about individuals and to explain the rights and specific actions that individuals may take or request to be taken regarding the uses and disclosures of their protected information. These rules also set forth the Authority’s requirements governing the use and disclosure of PHI for purposes of HIPAA, 42 USC 1320-d through 1320d-8, Pub L 104-191, sec. 262 and 264, and the implementing HIPAA privacy rules, 45 CFR parts 160 and 164, applicable to the Authority’s health care components.

(2) Except as provided in section (1) of this rule, state and federal statutes, rules, and policies that govern the administration of Authority programs, services, and activities continue to govern the use and disclosure of protected information in those Authority programs, services, and activities.

(3) In the event that it is not possible to comply with the requirements of both sections (1) and (2) of this rule, the Authority shall act in accordance with whichever federal or state law imposes a stricter requirement regarding the privacy or safeguarding of information and which provides the greater protection or access to the individual who is the subject of the information, unless one of the following applies:

(a) Public health. Nothing in these rules shall be construed to invalidate or limit the authority, power, or procedures established under any law providing for the reporting of disease or injury, birth, or death; public health surveillance; or public health investigation or intervention.

(b) Child abuse. Nothing in these rules shall be construed to invalidate or limit the authority, power, or procedures established under any law providing for the reporting of child abuse.

(c) State regulatory reporting. Nothing in these rules shall be construed to limit the ability of the State of Oregon or the Authority to require a health plan to report, or to provide access to information for management audits, financial audits, program monitoring, facility licensure or certification, or individual licensure or certification.

(4) The Authority may collect, maintain, use, transmit, share, and disclose information about any individual to the extent authorized by law to administer Authority programs, services, and activities.

(5) The Authority may use and disclose information about licensees or providers consistent with federal and state laws and regulations. Information regarding the qualifications of licensees and providers are public records.

(a) When the Authority obtains information about individuals that relates to determining payment responsibility when a provider submits a request for payment to the Authority, the Authority shall safeguard the information consistent with federal and state laws and regulations and Authority policies.

(b) The Authority may review the performance of licensees and providers in the conduct of its health oversight activities and shall safeguard information obtained about individuals obtained during those activities in accordance with federal and state laws and regulations and Authority policies.

Stat. Auth.: ORS 413.042

Stats. Implemented: ORS 179.505, 192.518 – 192.529, 411.010, 413.032 & 414.065

Hist.: OHA 8-2011(Temp), f. & cert. ef. 7-1-11 thru 12-27-11; OHA 22-2011, f. & cert. ef. 9-2-11

943-014-0015

Covered Entity Status for Purposes of the HIPAA Privacy Rules

(1) These rules address information that, among other things, may be Protected Health Information that is protected by the HIPAA Privacy Rules. For purposes of HIPAA Privacy Rules, the Authority is a hybrid entity because the Authority performs functions that are covered by HIPAA (“health care components”) and functions that are not covered by HIPAA. The Authority’s health care components consist of the functions that are included in the definition of a covered entity, as follows:

(a) The Authority in its capacity as the state Medicaid agency for the administration of the Medicaid program under Title XIX of the Social Security Act and the Children’s Health Insurance Program under Title XXI of the Act and the medical assistance program as described in ORS chapter 414.

(b) The Health Care for All Oregon Children program;

(c) The Family Health Insurance Assistance Program established in ORS 414.841 to 414.864;

(d) Any medical assistance or premium assistance programs reimbursed with Medicaid or the Children’s Health Insurance Program funds operated by the Authority;

(e) The Oregon State Hospital and Blue Mountain Recovery Center;

(f) The high risk pools administered by the Oregon Medical Insurance Pool Board and the Office of Private Health Partnerships;

(g) The Breast and Cervical Cancer Program and the Wise Woman Program;

(h) The Public Health Laboratory;

(i) The Medicaid Management Information system and information technology systems associated with the administration and management of the health care components listed above; and

(j) The ombudsman and other administrative and health care operations functions associated with the administration and management of the health care components listed above.

(2) The Authority administers many aspects of the medical assistance program with the assistance of the Department, including but not limited to eligibility determinations for the medical assistance program and supervising the long-term and community-based services for seniors and people with disabilities. The Department also provides certain health care operations services for the Authority. In doing so, the Department is a business associate of the Authority. As a business associate of the Authority, the Department is authorized to use and disclose protected health information to perform or assist the Authority in the performance of its covered functions.

(3) When these rules of the Authority apply to PHI that is subject to the HIPAA Privacy and Security rules, a reference to the Authority may also include the actions of the Department acting as the Authority’s business associate.

Stat. Auth.: ORS 413.042

Stats. Implemented: ORS 179.505, 192.518 – 192.529, 411.010, 413.032 & 414.065

Hist.: OHA 8-2011(Temp), f. & cert. ef. 7-1-11 thru 12-27-11; OHA 22-2011, f. & cert. ef. 9-2-11

943-014-0020

Uses and Disclosures of Client or Participant Protected Information

(1) Uses and disclosures with individual authorization. The Authority must obtain a completed and signed authorization for release of information from the individual, or the individual’s personal representative, before obtaining or using protected information about an individual from a third party or disclosing protected information about the individual to a third party.

(a) Uses and disclosures must be consistent with what the individual has approved on the signed authorization form approved by the Authority.

(b) An individual may revoke an authorization at any time. The revocation must be in writing and signed by the individual, except that substance abuse treatment patients may orally revoke an authorization to disclose information obtained from substance abuse treatment programs. No revocation shall apply to information already released while the authorization was valid and in effect.

(2) Uses and disclosures without authorization. The Authority may use and disclose information without written authorization in the following circumstances:

(a) The Authority may disclose information to individuals who have requested disclosure to themselves of their information, if the individual has the right to access the information under OAR 943-014-0030(6).

(b) If the law requires or permits the disclosure, and the use and disclosure complies with, and is limited to, the relevant requirements of the relevant law.

(c) For treatment, payment, and health care operations the Authority may disclose the following information:

(A) Activities involving the current treatment of an individual, for the Authority or health care provider;

(B) Payment activities, for the Authority, covered entity, or health care provider;

(C) Protected health information for the purpose of health care operations; and

(D) Substance abuse treatment information, if the recipient has a Qualified Service Organization Agreement with the Authority.

(d) Psychotherapy notes. The Authority may only use and disclose psychotherapy notes in the following circumstances:

(A) In the Authority’s supervised counseling training programs;

(B) In connection with oversight of the originator of the psychotherapy notes; or

(C) To defend the Authority in a legal action or other proceeding brought by the individual.

(e) Public health activities.

(A) The Authority may disclose an individual’s protected information to appropriate entities or persons for governmental public health activities and for other purposes including but not limited to:

(i) A governmental public health authority that is authorized by law to collect or receive protected information for the purpose of preventing or controlling disease, injury, or disability. This includes but is not limited to reporting disease, injury, and vital events such as birth or death; and the conducting of public health surveillance, investigations, and interventions;

(ii) An official of a foreign government agency that is acting in collaboration with a governmental public health authority;

(iii) A governmental public health authority, or other government authority that is authorized by law to receive reports of child abuse or neglect;

(iv) A person subject to the jurisdiction of the federal Food and Drug Administration (FDA), regarding an FDA-regulated product or activity for which that person is responsible for activities related to the quality, safety, or effectiveness of an FDA-regulated product or activity; or

(v) A person who may have been exposed to a communicable disease, or may be at risk of contracting or spreading a disease or condition, if the Authority or other public health authority is authorized to notify the person as necessary in conducting a public health intervention or investigation.

(B) Where state or federal law prohibits or restricts use and disclosure of information obtained or maintained for public health purposes, the Authority shall deny the use and disclosure.

(f) Child abuse reporting and investigation. If the Authority has reasonable cause to believe that a child is a victim of abuse or neglect, the Authority may disclose protected information to appropriate governmental authorities authorized by law to receive reports of child abuse or neglect.

(g) Adult abuse reporting and investigation. If the Authority has reasonable cause to believe that a vulnerable adult is a victim of abuse or neglect, the Authority may disclose information, as required by law, to a government authority or regulatory agency authorized by law to receive reports of abuse or neglect including but not limited to a social service or protective services agency authorized by law to receive such reports. Vulnerable adults are adults age 65 or older and persons with disabilities.

(h) Health oversight activities. The Authority may disclose information without authorization for health oversight activities, including audits; civil, criminal, or administrative investigations, prosecutions, licensing or disciplinary actions; Medicaid fraud; or other necessary oversight activities.

(i) Administrative and court hearings, grievances, investigations, and appeals.

(A) The Authority may use or disclose information for an investigation, administrative or court hearing, grievance, or appeal about an individual’s eligibility or right to receive Authority benefits or services.

(B) If the Authority has obtained information in performing its duties as a health oversight agency, public health authority, or public benefit program, the Authority may use or disclose that information in an administrative or court hearing consistent with the other privacy requirements applicable to that program, service, or activity.

(j) Court orders. The Authority may disclose information for judicial or administrative proceedings in response to a court order, subpoena, discovery request, or other legal process. If a court orders the Authority to conduct a mental examination pursuant to ORS 161.315, 161.365, 161.370, or orders the Authority to provide any other report or evaluation to the court, the examination, report, or evaluation shall be deemed to be required by law for purposes of HIPAA.

(k) Law enforcement purposes. For limited law enforcement purposes, the Authority may report certain injuries or wounds; provide information to identify or locate a suspect, victim, or witness; alert law enforcement of a death as a result of criminal conduct; and provide information which constitutes evidence of criminal conduct on Authority premises.

(A) The Authority may provide client information to a law enforcement officer in any of the following situations:

(i) The law enforcement officer is involved in carrying out any investigation, criminal, or civil proceedings connected with administering the program from which the information is sought;

(ii) An Authority employee may disclose information from personal knowledge that does not come from the client’s interaction with the Authority;

(iii) The disclosure is authorized by statute or administrative rule;

(iv) The information informs law enforcement of a death as a result of criminal conduct;

(v) The information constitutes evidence of criminal conduct on Authority premises; or

(vi) The disclosure is necessary to protect the client or others, and the client poses a threat to his or her safety or to the safety of others.

(B) Except as provided in section (2)(k)(C) of this rule, the Authority may give a client’s current address, Social Security number, and photo to a law enforcement officer if the law enforcement officer makes the request in the course of official duty, supplies the client’s name, and states that the client:

(i) Is a fugitive felon or is violating parole, probation, or post-prison supervision;

(ii) For all public assistance programs, has information that is necessary for the officer to conduct official duties, and the location or apprehension of the client is within the officer’s official duties; or

(C) If domestic violence has been identified in the household, the Authority may not release information about a victim of domestic violence unless a member of the household is either wanted as a fugitive felon or is violating parole, probation, or post-prison supervision.

(D) For purposes of this subsection, a fugitive felon is a person fleeing to avoid prosecution or custody for a crime, or an attempt to commit a crime, that would be classified as a felony.

(E) For purposes of this section, a law enforcement officer is an employee of the Oregon State Police, a county sheriff’s department, or a municipal police department, whose official duties include arrest authority.

(l) Use and disclosure of information about deceased individuals.

(A) The Authority may disclose individual information to a coroner or medical examiner for the purpose of identifying a deceased individual, determining cause of death, or other duties authorized by law.

(B) The Authority may disclose individual information to funeral directors as needed to carry out their duties regarding the decedent. The Authority may also disclose individual information prior to, and in anticipation of, the death.

(m) Organ or tissue donation. The Authority may disclose individual information to organ procurement organizations or other entities engaged in procuring, banking, or transplanting cadaver organs, eyes, or tissue for the purpose of facilitating transplantation.

(n) Research. The Authority may disclose individual information without authorization for research purposes, as specified in OAR 943-014-0060.

(o) Threat to health or safety. To avert a serious threat to health or safety the Authority may disclose individual information if:

(A) The Authority believes in good faith that the information is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public; and

(B) The report is to a person or persons reasonably able to prevent or lessen the threat, including the target of the threat.

(p) National security and intelligence. The Authority may disclose information to authorized federal officials for lawful intelligence, counterintelligence, and other national security activities.

(q) Correctional institutions and law enforcement custody situations. The Authority may disclose information to a correctional institution or a law enforcement official having lawful custody of an inmate or other person, for the limited purpose of providing health care or ensuring the health or safety of the person or other inmates.

(r) Emergency treatment. In case of an emergency, the Authority may disclose individual information to the extent needed to provide emergency treatment.

(s) Government entities providing public benefits. The Authority may disclose eligibility and other information to governmental entities administering a government program providing public benefits.

(3) Authorization not required if opportunity to object given. The Authority may use and disclose an individual’s information without authorization if the Authority informs the individual in advance and gives the individual an opportunity to either agree or refuse or restrict the use and disclosure.

(a) These disclosures are limited to disclosure of information to a family member, other relative, close personal friend of the individual, or any other person named by the individual, subject to the following limitations:

(A) The Authority may disclose only the protected information that directly relates to the person’s involvement with the individual’s care or payment for care.

(B) The Authority may use and disclose protected information for notifying, identifying, or locating a family member, personal representative, or other person responsible for care of the individual, regarding the individual’s location, general condition, or death. For individuals who had resided at one time at the state training center, OAR 411-320-0090(6) addresses family reconnection.

(C) If the individual is present for, or available prior to, a use and disclosure, the Authority may disclose the protected information if the Authority:

(i) Obtains the individual’s agreement;

(ii) Provides the individual an opportunity to object to the disclosure, and the individual does not object; or

(iii) Reasonably infers from the circumstances that the individual does not object to the disclosure.

(D) If the individual is not present, or the opportunity to object to the use and disclosure cannot practicably be provided due to the individual’s incapacity or an emergency situation, the Authority may disclose the information if, using professional judgment, the Authority determines that the use and disclosure is in the individual’s best interests.

(b) Exception. For individuals referred to or receiving substance abuse treatment, mental health, or vocational rehabilitation services, the Authority shall not use or disclose information without written authorization, unless disclosure is otherwise permitted under 42 CFR part 2, 34 CFR 361.38, or ORS 179.505.

(c) Personal representative. The Authority must treat a personal representative as the individual for purposes of these rules, except that:

(A) A personal representative must be authorized under state law to act on behalf of the individual with respect to use and disclosure of information. The Authority may require a personal representative to provide a copy of the documentation authorizing the person to act on behalf of the individual.

(B) The Authority may elect not to treat a person as a personal representative of an individual if:

(i) The Authority has a reasonable belief that the individual has been or may be subjected to domestic violence, abuse, or neglect by the person;

(ii) The Authority, in the exercise of professional judgment, decides that it is not in the best interest of the individual to treat the person as the individual’s personal representative.

(4) Redisclosure. The Authority must inform the individual that information held by the Authority and authorized by the individual for disclosure may be subject to redisclosure and no longer protected by these rules.

(5) Specific written authorization. If the use or disclosure of information requires an authorization, the authorization must specify that the Authority may use or disclose vocational rehabilitation records, alcohol and drug records, HIV/AIDS records, genetics information, and mental health or developmental disability records held by publicly funded providers.

(a) Pursuant to federal regulations at 42 CFR part 2 and 34 CFR 361.38, the Authority may not make further disclosure of vocational rehabilitation and alcohol and drug rehabilitation information without the specific written authorization of the individual to whom it pertains.

(b) Pursuant to ORS 433.045 and OAR 333-012-0270, the Authority may not make further disclosure of individual information pertaining to HIV/AIDS.

(c) Pursuant to ORS 192.531 to 192.549, the Authority may not make further disclosure pertaining to genetic information.

(6) Verification of person or entity requesting information. The Authority may not disclose information about an individual without first verifying the identity of the person or entity requesting the information, unless the Authority workforce member fulfilling the request already knows the person or has already verified identity.

(7) Whistleblowers. The Authority may disclose an individual’s protected health information under the HIPAA privacy rules under the following circumstances:

(a) The Authority workforce member or business associate believes in good faith that the Authority has engaged in conduct that is unlawful or that otherwise violates professional standards or Authority policy, or that the care, services, or conditions provided by the Authority could endanger Authority staff, individuals in Authority care, or the public; and

(b) The disclosure is to a government oversight agency or public health authority, or an attorney of an Authority workforce member or business associate retained for the purpose of determining the legal options of the workforce member or business associate with regard to the conduct alleged under section (7)(a) above; and

(c) Nothing in this rule is intended to interfere with ORS 659A.200 to 659A.224 describing the circumstances applicable to disclosures by Authority workforce or business associates.

Stat. Auth.: ORS 413.042

Stats. Implemented: ORS 179.505, 192.518 – 192.529, 411.010, 413.032 & 414.065

Hist.: OHA 8-2011(Temp), f. & cert. ef. 7-1-11 thru 12-27-11; OHA 22-2011, f. & cert. ef. 9-2-11

943-014-0030

Client Privacy Rights

(1) Rights of clients to access their information. Clients may access, inspect, and obtain a copy of information on their own cases in Authority files or records, consistent with federal and state law.

(a) A client may request access by completing the Access to Records Request form, or by providing sufficient information to accomplish this request.

(b) Clients may request access to their own information that is kept by the Authority by using a personal identifier such as the client’s name or Authority case number.

(c) If the Authority maintains information in a record that includes information about other people, the client may see information only about himself or herself.

(d) If a person identified in the file is a minor child of the client, and the client is authorized under Oregon law to have access to the minor’s information or to act on behalf of the minor for making decisions about the minor’s care, the client may obtain information about the minor.

(e) If the requestor of information is recognized under Oregon law as a the client’s guardian or custodian and is authorized under Oregon law to have access to the client’s information or to act on behalf of the client for making decisions about the client’s services or care, the Authority shall release information to the requestor.

(f) For individuals with disabilities or mental illnesses, the named system in ORS 192.517, to protect and advocate the rights of individuals with developmental disabilities under Part C of the Developmental Disabilities Assistance and Bill of Rights Act (42 U.S.C. 6041 et seq.) and the rights of individuals with mental illness under the Protection and Advocacy for Individuals with Mental Illness Act (42 U.S.C. 10801 et seq.), shall have access to all records defined in ORS 192.515.

(g) The Authority may deny a client’s access to their own PHI if federal law prohibits the disclosure. Clients may access, inspect, and obtain a copy of health information on their own case in Authority files or records except for the following:

(A) Psychotherapy notes;

(B) Information compiled in reasonable anticipation of, or for use in civil, criminal, or administrative proceedings;

(C) Information that is subject to the federal Clinical Labs Improvement Amendments of 1988, or exempt pursuant to 42 CFR 493.3(a)(2);

(D) Information that the Authority believes, in good faith, can cause harm to the client, participant, or to any other person; and

(E) Documents protected by attorney work-product privilege.

(h) The Authority may deny a client access to information that was obtained under a promise of confidentiality from a person other than a health care provider to the extent that access would reveal the source of the information.

(i) The Authority may deny a client access to information, if the Authority gives the client a right to have the denial reviewed when:

(A) A licensed health care professional (for health information) or other designated staff (for other information) has determined, in the exercise of professional judgment, that the information requested may endanger the life or physical safety of the client or another person;

(B) The information makes reference to another person, and a licensed health care professional (for health information) or other designated staff (for other information) has determined, in the exercise of professional judgment, that the information requested may cause substantial harm to the client or to another person; or

(C) The request for access is made by the client’s personal representative, and a licensed health care professional (for health information) or other designated staff (for other information) has determined, in the exercise of professional judgment, that allowing the personal representative access to the information may cause substantial harm to the client or to another person.

(j) If the Authority denies access under section (1)(i) of this rule, the client may have the decision reviewed by a licensed health care professional (for health information) or other designated staff (for other information) not directly involved in making the original denial decision.

(A) The Authority must promptly refer a client’s request for review to the designated reviewer.

(B) The reviewer must determine, within the 30 or 60-day time limits stated in section (1)(k)(A) and (B) of this rule, whether to approve or deny the client’s request for access.

(C) Based on the reviewer’s decision, the Authority shall:

(i) Promptly notify the client in writing of the reviewer’s determination; and

(ii) If approved, take action to carry out the reviewer’s determination.

(k) The Authority must act on a client’s request for access no later than 30 days after receiving the request, except as provided in this section and in the case of written accounts under ORS 179.505, which must be disclosed within five days.

(A) In cases where the information is not maintained or accessible to the Authority on-site, and does not fall under ORS 179.505, the Authority must act on the client’s request no later than 60 days after receiving the request.

(B) If the Authority is unable to act within the 30 or 60-day limits, the Authority may extend this time period a maximum of 30 additional days, subject to the following:

(i) The Authority must notify the client in writing of the reasons for the delay and the date by which the Authority shall act on the request.

(ii) The Authority shall use only one 30-day extension.

(l) If the Authority grants the client’s request, in whole or in part, the Authority must inform the client of the access decision and provide the requested access.

(A) If the Authority maintains the same information in more than one format or at more than one location, the Authority may provide the requested information once.

(B) The Authority must provide the requested information in a form or format requested by the client, if readily producible in that form or format. If not readily producible, the Authority shall provide the information in a readable hard-copy format or other format as agreed to by the Authority and the client.

(C) The Authority may provide the client with a summary of the requested information, in lieu of providing access, or may provide an explanation of the information if access has been provided, if:

(i) The client agrees in advance; and

(ii) The client agrees in advance to pay any fees the Authority may impose, under section (1)(L)(E) of this rule.

(D) The Authority shall arrange with the client for providing the requested access in a time, place, and manner convenient for the client and the Authority.

(E) If a client, or legal guardian or custodian, requests a copy, written summary, or explanation of the requested information, the Authority may impose a reasonable cost-based fee, limited to the following:

(i) Copying the requested information, including the costs of supplies and the labor of copying;

(ii) Postage; and

(iii) Staff time for preparing an explanation or summary of the requested information.

(m) If the Authority denies access, in whole or in part, to the requested information, the Authority must:

(A) Give the client access to any other requested client information, after excluding the information to which access is denied; and

(B) Provide the client with a timely written denial. The denial must:

(i) Be provided within the time limits specified in section (1)(k)(A) and (B) of this rule;

(ii) State the basis of the denial in plain language;

(iii) If the Authority denies access under section (1)(i) of this rule, explain the client’s review rights as specified in section (1)(j) of this rule, including an explanation of how the client may exercise these rights; and

(iv) Provide a description of how the client may file a complaint with the Authority, and if the information is PHI, with the United States Department of Health and Human Services (DHHS), Office for Civil Rights, pursuant to section (7) of this rule.

(n) If the Authority does not maintain the requested information, in whole or in part, and knows where the information is maintained (such as by a medical provider, insurer, other public agency, private business, or other non-Authority entity), the Authority must inform the client where to direct the request for access.

(2) Authority Notice of Privacy Practices. The Authority shall send clients notice about the Authority’s privacy practices as follows:

(a) The Authority shall make available to each client a notice of Authority privacy practices that describes the duty of the Authority to maintain the privacy of PHI and include a description that clearly informs the client of the types of uses and disclosures the Authority is permitted or required to make;

(b) The Authority shall provide all clients in direct care settings a notice of Authority privacy practices and shall request the client’s signature on an acknowledgement of receipt form;

(c) If the Authority revises its privacy practices, the Authority shall make the revised notice available to all clients;

(d) The Authority shall post a copy of the Authority’s Notice of Privacy Practices for public viewing at each Authority worksite and on the Authority website; and

(e) The Authority shall give a paper copy of the Authority’s Notice of Privacy Practices to any individual upon request.

(3) Right to request restrictions on uses or disclosures. Clients may request restrictions on the use or disclosure of their information.

(a) The Authority may deny the client’s request or limit its agreement to a request.

(A) The Authority may not agree to restrict uses or disclosures of information if the restriction would adversely affect the quality of the client’s care or services.

(B) The Authority may not agree to restrict uses or disclosures of information that would limit or prevent the Authority from making or obtaining payment for services.

(b) The Authority may not deny a client’s request to restrict the sharing of records of alcohol and drug treatment or records relating to vocational rehabilitation services with another Authority program.

(c) The Authority shall document the client’s request, and the reasons for granting or denying the request, in the client’s Authority case file.

(d) If the client needs emergency treatment and the restricted protected information is needed to provide the treatment, the Authority may use or disclose the restricted protected information to a provider, for the limited purpose of providing treatment. However, once the emergency situation subsides the Authority shall ask the provider not to redisclose the information.

(e) The Authority may terminate its agreement to a restriction if:

(A) The client agrees to or requests the termination in writing;

(B) The client orally requests or agrees to the termination, and the Authority documents the oral request or agreement in the client’s Authority case file; or

(C) With or without the client’s agreement, the Authority informs the client that the Authority is terminating its agreement to the restriction. Information created or received while the restriction was in place shall remain subject to the restriction.

(4) Rights of clients to request to receive information from the Authority by alternative means or at alternative locations. The Authority must accommodate reasonable requests by clients to receive communications from the Authority by alternative means, such as by mail, e-mail, fax, or telephone, and at an alternative location.

(a) The client must specify the preferred alternative means or location.

(b) The client may submit the request for alternative means or locations either orally or in writing.

(A) If the client makes a request in-person, the Authority shall document the request and ask for the client’s signature.

(B) If the client makes a request by telephone or electronically, the Authority shall document the request and verify the identity of the client.

(c) The Authority may terminate its agreement to an alternative location or method of communication if:

(A) The client agrees to or requests termination of the alternative location or method of communication in writing or orally. The Authority shall document the oral agreement or request in the client’s Authority case file; or

(B) The Authority informs the client that the Authority is terminating its agreement to the alternative location or method of communication because the alternative location or method of communication is not effective. The Authority may terminate its agreement to communicate at the alternative location or by the alternate method if:

(i) The Authority is unable to contact the client at the location or by the method requested; or

(ii) The client fails to respond to payment requests, if applicable.

(5) Right of clients to request amendment of their information. Clients may request that the Authority amend information about themselves in Authority files.

(a) For all amendment requests, the Authority shall have the client complete the approved Authority form.

(b) The Authority may deny the request or limit its agreement to amend.

(c) The Authority must act on the client’s request no later than 60 days after receiving the request. If the Authority is unable to act within 60 days, the Authority may extend this time limit by a maximum of 30 additional days, subject to the following:

(A) The Authority must notify the client in writing, within 60 days of receiving the request, of the reasons for the delay and the date by which the Authority shall act on the request; and

(B) The Authority shall use only one 30-day extension.

(d) The program’s medical director, a licensed health care professional designated by the program administrator, or an Authority staff person involved in the client’s case must review the request and any related documentation prior to making a decision to amend a health or medical record.

(e) A staff person designated by the Authority shall review the request and any related documentation prior to making a decision to amend any information that is not a health or medical record.

(f) If the Authority grants the request, in whole or in part, the Authority shall:

(A) Make the appropriate amendment to the information or records, and document the amendment in the client’s Authority file or record;

(B) Provide notice to the client that the amendment has been granted, pursuant to the time limits under section (5)(c) of this rule;

(C) Obtain the client’s agreement to notify other relevant persons or entities with whom the Authority has shared or needs to share the amended information; and

(D) Inform and provide the amendment within a reasonable time to:

(i) Persons named by the client who have received the information and who need the amendment; and

(ii) Persons, including business associates of the Authority, that the Authority knows have the information that is the subject of the amendment and who may have relied, or could foreseeably rely, on the information to the client’s detriment.

(g) The Authority may deny the client’s request for amendment if:

(A) The Authority finds the information to be accurate and complete;

(B) The information was not created by the Authority;

(C) The information is not part of Authority records; or

(D) The information would not be available for inspection or access by the client, pursuant to section (1)(g) and (h) of this rule.

(h) If the Authority denies the amendment request, in whole or in part, the Authority must provide the client with a written denial. The denial must:

(A) Be sent within the time limits specified in section (5)(c) of this rule;

(B) State the basis for the denial, in plain language; and

(C) Explain the client’s right to submit a written statement disagreeing with the denial and how to file the statement. If the client files a statement:

(i) The Authority shall enter the written statement into the client’s Authority case file;

(ii) The Authority may also enter an Authority written rebuttal of the client’s written statement into the client’s Authority case file. The Authority shall send a copy of any written rebuttal to the client;

(iii) The Authority shall include a copy of the statement and any Authority written rebuttal with any future disclosures of the relevant information;

(iv) If a client does not submit a written statement of disagreement, the client may ask that if the Authority makes any further disclosures of the relevant information that the Authority shall also include a copy of the client’s original request for amendment and a copy of the Authority written denial; and

(v) The Authority shall provide information on how the client may file a complaint with the Authority and, if the information is PHI, with DHHS, Office for Civil Rights.

(6) Rights of clients to request an accounting of disclosures of PHI. Clients may receive an accounting of disclosures of PHI that the Authority has made for any period of time, not to exceed six years, preceding the request date for the accounting.

(a) For all requests for an accounting of disclosures, the client may complete the authorized Authority form “Request for Accounting of Disclosures of Health Records”, or provide sufficient information to accomplish this request.

(b) The right to an accounting of disclosures does not apply when the request is:

(A) Authorized by the client;

(B) Made prior to April 14, 2003;

(C) Made to carry out treatment, payment, or health care operations, unless these disclosures are made from an electronic health record;

(D) Made to the client;

(E) Made to persons involved in the client’s care;

(F) Made as part of a limited data set in accordance with OAR 943-014-0070;

(G) Made for national security or intelligence purposes; or

(H) Made to correctional institutions or law enforcement officials having lawful custody of an inmate.

(c) For each disclosure, the accounting must include:

(A) The date of the disclosure;

(B) The name and address, if known, of the person or entit, who received the disclosed information;

(C) A brief description of the information disclosed; and

(D) A brief statement of the purpose of the disclosure that reasonably informs the client of the basis for the disclosure, or, in lieu of a statement, a copy of the client’s written request for a disclosure, if any.

(d) If, during the time period covered by the accounting, the Authority has made multiple disclosures to the same person or entity for the same purpose, the Authority may provide the required information for only the first disclosure. The Authority need not list the same identical information for each subsequent disclosure to the same person or entity if the Authority adds the following information:

(A) The frequency or number of disclosures made to the same person or entity; and

(B) The date of the most recent disclosure during the time period for which the accounting is requested.

(e) The Authority must act on the client’s request for an accounting no later than 60 days after receiving the request. If the Authority is unable to act within 60 days, the Authority may extend this time limit by a maximum of 30 additional days, subject to the following:

(A) The Authority must notify the client in writing, within 60 days of receiving the request, of the reasons for the delay and the date by which the Authority shall act on the request; and

(B) The Authority shall use only one 30-day extension.

(f) The Authority shall provide the first requested accounting in any 12-month period without charge. The Authority may charge the client a reasonable cost-based fee for each additional accounting requested by the client within the 12-month period following the first request, if the Authority:

(A) Informs the client of the fee before proceeding with any additional request; and

(B) Allows the client an opportunity to withdraw or modify the request in order to avoid or reduce the fee.

(g) The Authority shall document the information required to be included in an accounting of disclosures, as specified in section (6)(c) of this rule, and retain a copy of the written accounting provided to the client.

(h) The Authority shall temporarily suspend a client’s right to receive an accounting of disclosures that the Authority has made to a health oversight agency or to a law enforcement official, for a length of time specified by the agency or official, if the agency or official provides a written or oral statement to the Authority that the accounting would be reasonably likely to impede their activities. If the agency or official makes an oral request, the Authority shall:

(A) Document the oral request, including the identity of the agency or official making the request.

(B) Temporarily suspend the client’s request to an accounting of disclosures; and

(C) Limit the temporary suspension to no longer than 30 days from the date of the oral request, unless the agency or official submits a written request specifying a longer time period.

(7) Filing a complaint. Clients may file a complaint with the Authority or, if the information is PHI, with DHHS, Office for Civil Rights.

(a) Upon request, the Authority shall give clients the name and address of the specific person or office of where to submit complaints to DHHS.

(b) The Authority may not intimidate, threaten, coerce, discriminate against, or take any other form of retaliatory action against any individual filing a complaint or inquiring about how to file a complaint.

(c) The Authority may not require clients to waive their rights to file a complaint as a condition of providing treatment, payment, enrollment in a health plan, or eligibility for benefits.

(d) The Authority shall designate staff to review and determine action on complaints filed with the Authority.

(e) The Authority shall document, in the client’s Authority case file all complaints, the findings from reviewing each complaint, and the Authority’s actions resulting from the complaint. For each complaint the documentation shall include a description of corrective action that the Authority has taken, if any are necessary, or why corrective action is not needed.

Stat. Auth.: ORS 413.042

Stats. Implemented: ORS 179.505, 192.518 – 192.529, 411.010, 413.032 & 414.065

Hist.: OHA 8-2011(Temp), f. & cert. ef. 7-1-11 thru 12-27-11; OHA 22-2011, f. & cert. ef. 9-2-11

943-014-0040

Minimum Necessary Standards

(1) The Authority shall limit the use and disclosure of protected information to that which is reasonably necessary to accomplish the intended purpose of the use or disclosure which is referred to in these rules as the minimum necessary standard.

(2) This minimum necessary standard is not intended to impede the essential Authority activities of treatment, payment, health care operations, or service delivery.

(3) The minimum necessary standard applies:

(a) When using protected information within the Authority;

(b) When disclosing protected information to a third party in response to a request; or

(c) When requesting protected information from another covered entity.

(4) The minimum necessary standard does not apply to:

(a) Disclosures to or requests by a health care provider for treatment;

(b) Disclosures made to the individual, including disclosures made in response to a request for access or an accounting;

(c) Disclosures made with a valid authorization;

(d) Disclosures made to DHHS for the purposes of compliance and enforcement of federal regulations under 45 CFR part 160 and required for compliance with 45 CFR part 164.; or

(e) Uses and disclosures required by law;

(5) When requesting protected information about an individual from another entity, the Authority shall limit requests to those that are reasonably necessary to accomplish the purposes for which the request is made. The Authority shall not request a person’s entire medical record unless the Authority can specifically justify the need for the entire medical record.

Stat. Auth.: ORS 413.042

Stats. Implemented: ORS 179.505, 192.518 – 192.529, 411.010, 413.032 & 414.065

Hist.: OHA 8-2011(Temp), f. & cert. ef. 7-1-11 thru 12-27-11; OHA 22-2011, f. & cert. ef. 9-2-11

943-014-0050

Business Associate

(1) The Authority may disclose an individual’s PHI to a business associate, and may allow a business associate to create or receive an individual’s PHI on behalf of the Authority if the Authority and the business associate first enter into a contract that complies with applicable federal and state law. In some limited circumstances, the Authority may determine that the Authority is a business associate of a covered entity. A business associate relationship with the Authority requires additional contractual disclosure and privacy provisions that must be incorporated into the contract pursuant to 45 CFR part 164-504 (e)(1)

(2) A contract with a business associate must comply with OAR 125-055-0100 to 125-055-0130 and the qualified service organization requirements in 42 CFR part 2.11.

Stat. Auth.: ORS 413.042

Stats. Implemented: ORS 179.505, 192.518 – 192.529, 411.010, 413.032 & 414.065

Hist.: OHA 8-2011(Temp), f. & cert. ef. 7-1-11 thru 12-27-11; OHA 22-2011, f. & cert. ef. 9-2-11

943-014-0060

Uses and Disclosures of Protected Information for Research Purposes

The Authority may use and disclose an individual’s information for research purposes as specified in this rule.

(1) All research disclosures are subject to applicable requirements of federal and state laws and rules including but not limited to 45 CFR part 46 and 21 CFR part 50.0 to 50.56, relating to the protection of human research subjects.

(2) The Authority may use and disclose de-identified information or a limited data set for research purposes, pursuant to OAR 943-014-0070.

(3) The Authority may use and disclose information regarding an individual for research purposes with the specific written authorization of the individual. The authorization must meet all requirements in OAR 943-014-0030, and may indicate an expiration date with terms such as “end of research study” or similar language. An authorization for use and disclosure for a research study may be combined with other types of written authorization for the same research study. If research includes treatment, the researcher may require an authorization for use and disclosure for the research as a provision of providing research related treatment.

(4) Notwithstanding section (3) of this rule, the Authority may use and disclose an individual’s information for research purposes without the individual’s written authorization, regardless of the source of funding for the research, provided that:

(a) The Authority obtains documentation that a waiver of an individual’s authorization for release of information requirements has been approved by an IRB registered with the Office for Human Research Protection. Documentation required of an IRB when granting approval of a waiver of an individual’s authorization for release of information must include all criteria specified in 45 CFR part 164.512(i)(2).

(b) A researcher may request access to individual information maintained by the Authority in preparation for research or to facilitate the development of a research protocol in anticipation of research. The Authority may determine whether to permit such use or disclosure, without individual authorization or use of an IRB, pursuant to 45 CFR part 164.512(i)(1)(ii).

(c) A researcher may request access to individual information maintained by the Authority about deceased individuals. The Authority may determine whether to permit such use or disclosure of information about decedents, without individual authorization or use of an IRB, pursuant to 45 CFR part 164.512(i)(1)(iii).

(5) The Authority, as a public health authority, may obtain and use individual information without authorization for the purpose of preventing injury or controlling disease and for the conduct of public health surveillance, investigations, and interventions. The Authority may also collect, use, or disclose information, without individual authorization, to the extent that the collection, use, or disclosure is required by law. When the Authority uses information to conduct studies as a public health authority, no additional individual authorization is required nor does this rule require an IRB or privacy board waiver of authorization based on the HIPAA privacy rules.

(6) The Authority may use and disclose information without individual authorization for studies and data analysis conducted for the Authority’s own quality assurance purposes or to comply with reporting requirements applicable to federal or state funding requirements in accordance with the definition of “Health Care Operations” in 45 CFR part 164.501.

Stat. Auth.: ORS 413.042

Stats. Implemented: ORS 413.042

Stats. Implemented: ORS 179.505, 192.518 – 192.529, 411.010, 413.032 & 414.065

Hist.: OHA 8-2011(Temp), f. & cert. ef. 7-1-11 thru 12-27-11; OHA 22-2011, f. & cert. ef. 9-2-11

943-014-0070

De-identification of Client Information and Use of Limited Data Sets under Data Use Agreements

(1) The Authority may use and disclose information as appropriate for the work of the Authority, without further restriction, if the Authority or another entity has taken steps to de-identify the information pursuant to 45 CFR part 164.514(a) and (b).

(2) The Authority may assign a code or other means of record identification to allow the Authority to re-identify the de-identified information provided that:

(a) The code or other means of record identification is not derived from or related to information about the individual and cannot otherwise be translated to identify the individual; and,

(b) The Authority does not use or disclose the code or other means of record identification for any other purpose, and does not disclose the mechanism for re-identification.

(3) The Authority may use and disclose a limited data set if the Authority enters into a data use agreement with an entity requesting or providing the Authority with a limited data set subject to the requirements of 45 CFR part 164.514(e).

(a) The Authority may use and disclose a limited data set only for the purposes of research, public health, or health care operations. The Authority may use limited data set for its own activities or operations if the Authority has obtained a limited data set that is subject to a data use agreement.

(b) If the Authority knows of a pattern of activity or practice of a limited data set recipient that constitutes a material breach or violation of a data use agreement, the Authority shall take reasonable steps to cure the breach or end the violation. If such steps are unsuccessful, the Authority shall discontinue disclosure of information to the recipient and report the problem to the Secretary of DHHS.

Stat. Auth.: ORS 413.042

Stats. Implemented: ORS 179.505, 192.518 – 192.529, 411.010, 413.032 & 414.065

Hist.: OHA 8-2011(Temp), f. & cert. ef. 7-1-11 thru 12-27-11; OHA 22-2011, f. & cert. ef. 9-2-11

Notes
1.) This online version of the OREGON BULLETIN is provided for convenience of reference and enhanced access. The official, record copy of this publication is contained in the original Administrative Orders and Rulemaking Notices filed with the Secretary of State, Archives Division. Discrepancies, if any, are satisfied in favor of the original versions. Use the OAR Revision Cumulative Index found in the Oregon Bulletin to access a numerical list of rulemaking actions after November 15, 2010.

2.) Copyright 2011 Oregon Secretary of State: Terms and Conditions of Use

Oregon Secretary of State • 136 State Capitol • Salem, OR 97310-0722
Phone: (503) 986-1523 • Fax: (503) 986-1616 • oregon.sos@state.or.us

© 2013 State of Oregon All Rights Reserved​