Loading
The Oregon Administrative Rules contain OARs filed through October 15, 2014
 
QUESTIONS ABOUT THE CONTENT OR MEANING OF THIS AGENCY'S RULES?
CLICK HERE TO ACCESS RULES COORDINATOR CONTACT INFORMATION

 

OREGON HEALTH AUTHORITY, OFFICE FOR OREGON HEALTH POLICY AND RESEARCH

 

DIVISION 21

ACCESS OF DATA AND FEES FOR DATA SEARCH

409-021-0005

Introduction

This division defines the access to the health data collected from various sources and stored at the Office for Oregon Health Policy and Research.

Stat. Auth.: ORS 442.420(3)(d)
Stats. Implemented: ORS 192.410 - 192.440 & 442.420(3)(d)
Hist.: SHPD 5-1986, f. & ef. 1-24-86; HP 2-1988, f. & cert. ef. 3-25-88; HP 2-1992, f. & cert. ef. 10-19-92; HP 2-1994, f. & cert. ef. 4-22-94; HP 1-1996, f. & cert. ef. 1-2-96; OHP 1-1997, f. & cert. ef. 8-25-97; OHP 1-2002, f. & cert. ef. 1-2-02

409-021-0010

Definitions

As used in this division:

(1) "Computer" means a desktop personal computer physically located in the Office.

(2) "Data use agreement" means the terms, conditions, restrictions, and other rules governing the use of health data as specified in Form D-1 (Research Data Request) and in Form D-3 (OHPR Data Use Agreement).

(3) "Electronic media" means the consumer media commonly used to store and transport up to 4.7 GB of data. This includes, but is not limited to, floppy diskettes, CDs, DVDs, and other forms of removable storage media.

(4) "Format" means the way health data appears in a display, on electronic media, on printed copy, or in output or data files produced by the Office's computer software.

(5) "Health data" means an electronic or printed copy of a document, book, paper, file, or other materials, regardless of mode received, that is filed or maintained in pursuit of law or in connection with the transaction of public business. Health data reported to the Office from hospitals and other health care facilities may include information that is protected health information when it is maintained at the hospital or health care facility. The Office obtains such information because it is required by law, and because the Office acts in the capacity of a health oversight agency. The Office is not a covered entity or a business associate of a covered entity. Health data may include, but is not limited to:

(a) The socioeconomic and demographic characteristics of a population;

(b) The incidence of specific diseases or injuries;

(c) The severity of the diseases and injuries;

(d) The supply of health care services;

(e) Characteristics of the health care providers;

(f) The utilization of health care services; or

(g) Determining the need for health care services.

(6) "HIPAA" means the federal Health Insurance Portability and Accountability Act of 1996 and the regulations published Title 45, Parts 160 and 164, of the Code of Federal Regulations.

(7) "Office" means the Office for Oregon Health Policy and Research.

(8) "Person" means any natural person, corporation, partnership, firm, association or member or committee of the Legislative Assembly.

(9) "Public use health data file" means an aggregation of health data without personal identifiers that are publicly available for download, available through electronic mail, or available for delivery on electronic media, and at the Office's discretion may require an approved data use agreement.

(10) "Requestor" means the person who:

(a) Requests to inspect health data as provided in OAR 409-021-0120.

(b) Requests one or more copies of one or more public use health data files as provided in OAR 409-021-0130.

(c) Requests one or more copies of one or more limited health data sets as provided in OAR 409-021-0140.

(11) "Restricted health data set" means health data, other than routinely available public use data files, provided exclusively for purposes that are specified in an approved data use agreement. Limited data sets as defined by HIPAA shall be considered restricted health data sets.

(12) "Software" means a proprietary package of written programming language that instructs a computer to perform certain tasks.

(13) "Staff time" means the total time required by staff to complete a data request starting from initial contact to final contact with requestor, including searching for information, summarizing, duplicating, accessing the data, or any other time required by staff to complete the request.

(14) "State" means the State of Oregon.

Stat. Auth.: ORS 192.440 & 442.420(3)(d)
Stats. Implemented: ORS 192.410 - 192.440 & 442.420(3)(d)
Hist.: SHPD 5-1986, f. & ef. 1-24-86; HP 2-1988, f. & cert. ef. 3-25-88; HP 1-1996, f. & cert. ef. 1-2-96; OHP 1-1997, f. & cert. ef. 8-25-97; OHP 1-2002, f. & cert. ef. 1-2-02; OHP 1-2007, f. 1-29-07, cert. ef. 2-1-07

409-021-0115

Calculation of Fees

The Office shall charge fees necessary to fully recover the reasonable costs of responding to data requests and requests to examine health data maintained by the Office.

(1) The costs that the Office shall recover include, but are not limited to:

(a) Cost of materials and copying as provided in OAR 409-909-0020.

(b) Cost of staff time necessary to respond to the request.

(c) Administrative costs necessary to process the request.

(d) Any reasonable additional costs the Office deems necessary to respond to the request.

(2) Upon receipt of a completed form D-1, the Office shall provide a written estimate of fees within a reasonable period of time, unless the complete fees for the data request are the published fees for obtaining copies of public use health data files.

(3) The Office reserves the right to discount or waive fees for State agencies or at the discretion of the Administrator of the Office.

(4) The Office may develop contractual agreements for routinely providing data to a person at a discounted fee, upon approval of the Administrator of the Office.

Stat. Auth.: ORS 192.440 & 442.420(3)(d)
Stats. Implemented: ORS 192.410 - 192.440 & 442.420(3)(d)
Hist.: SHPD 5-1986, f. & ef. 1-24-86; HP 2-1988, f. & cert. ef. 3-25-88; HP 1-1996, f. & cert. ef. 1-2-96; Renumbered from 409-021-0025, OHP 1-2007, f. 1-29-07, cert. ef. 2-1-07

409-021-0120

Inspection of Health Data

(1) An inspection of the health data that are maintained at the Office shall be only by appointment during the normal working days and business hours of the Office.

(2) Requests to inspect health data that are maintained by the Office may, at the Office's discretion, require an approved data use agreement as provided in OAR 409-021-0130(1).

(3) The inspection shall take place at the Office; on a case-by-case basis, other reasonable locations may be designated at the sole discretion of the Administrator of the Office.

(4) The inspection of the requested data shall be in a format commonly employed by the Office for maintaining the requested data.

(5) Recovery of fees, if any, shall take place at the time of inspection.

Stat. Auth.: ORS 192.440 & 442.420(3)(d)
Stats. Implemented: ORS 192.410 - 192.440 & 442.420(3)(d)
Hist.: SHPD 5-1986, f. & ef. 1-24-86; HP 2-1988, f. & cert. ef. 3-25-88; HP 1-1996, f. & cert. ef. 1-2-96; Renumbered from 409-021-0020, OHP 1-2007, f. 1-29-07, cert. ef. 2-1-07

409-021-0130

Requests to Obtain Copies of Public Use Health Data Files

(1) Any requestor who wishes to obtain copies of public use health data files maintained by the Office shall provide all of the following:

(a) Form D-1 (Research Data Request).

(b) Form D-2 (Data Order Form).

(c) Form D-3 (Data Use Agreement).

(d) Full payment of fees.

(2) All requests for public use health data files require the written approval of the Research and Data Manager.

(3) Upon approval and receipt of full payment of fees, one copy of the requested public use health data file will be provided to the requestor.

(4) The Office shall respond to public use health data file requests within a reasonable period of time, except that the Office's response may be delayed so that critical operations and activities are not unduly disrupted. The Office shall notify the requestor in writing if an extensive delay is anticipated.

(5) This rule shall not apply to health data that the Office routinely makes available for direct download from the Office's web site.

(6) The public use files may not be used to identify any individual, including but not limited to patients, physicians, and other health care providers. The requestor may not use outside information to attempt to ascertain the identity of particular individuals who are the subject of public use files.

[ED. NOTE: Forms referred are available from the agency.]

Stat. Auth.: ORS 192.440 & 442.420(3)(d)
Stats. Implemented: ORS 192.410 - 192.440, 192.496, 192.501 & 442.420(3)(d)
Hist.: SHPD 5-1986, f. & ef. 1-24-86; HP 2-1988, f. & cert. ef. 3-25-88; HP 2-1992, f. & cert. ef. 10-19-92; HP 2-1994, f. & cert. ef. 4-22-94; HP 1-1996, f. & cert. ef. 1-2-96; OHP 1-1997, f. & cert. ef. 8-25-97; OHP 1-2002, f. & cert. ef. 1-2-02; Renumbered from 409-021-0015, OHP 1-2007, f. 1-29-07, cert. ef. 2-1-07; OHP 1-2013, f. 1-24-13, cert. ef. 2-1-13

409-021-0140

Requests and Requirements to Obtain Restricted Health Data Sets

(1) The Office may authorize the disclosure of health data in accordance with an approved data use agreement entered into by both the Office and a researcher, pursuant to which the Office may disclose a restricted health data set to a researcher for research, public health, or health care operations. The intent of this rule is to generally apply the legal standard established in the HIPAA Privacy Rule applicable to limited data sets, 45 CFR 164.514(e).

(2) Any requestor who wishes to obtain restricted health data sets from the Office shall provide all of the following:

(a) Form D-1 (Research Data Request)

(b) Form D-2 (Data Order Form)

(c) Form D-3 (Data Use Agreement)

(d) Full payment of fees.

(3) All requests for restricted health data sets require the written approval of the Research and Data Manager.

(4) Upon approval and receipt of full payment of fees, the Office is authorized to provide one copy of the requested restricted health data set to the requestor.

(5) The Office shall respond to restricted health data set requests within a reasonable period of time, except that the Office's response may be delayed so that critical operations and activities are not unduly disrupted. The Office shall notify the requestor in writing if an extensive delay is anticipated.

[ED. NOTE: Forms referred are available from the agency.]

Stat. Auth.: ORS 192.440 & 442.420(3)(d)
Stats. Implemented: ORS 192.410 - 192.440 & 442.420(3)(d)
Hist.: SHPD 5-1986, f. & ef. 1-24-86; HP 2-1988, f. & cert. ef. 3-25-88; HP 2-1992, f. & cert. ef. 10-19-92; HP 2-1994, f. & cert. ef. 4-22-94; HP 1-1996, f. & cert. ef. 1-2-96; OHP 1-1997, f. & cert. ef. 8-25-97; OHP 1-2002, f. & cert. ef. 1-2-02; Renumbered from 409-021-0030, OHP 1-2007, f. 1-29-07, cert. ef. 2-1-07

409-021-0150

Denial of Requests to Inspect or Obtain Copies of Health Data

The Office shall deny requests to inspect health data, receive copies of public use health data sets, and receive copies of restricted health data sets in order to prevent uses that are not consistent with current agreements, policies, rules, regulations, or statutes.

(1) The Office shall deny requests to examine health data or receive copies of health data for reasons that include, but are not limited to:

(a) Fulfilling the request violates one or more of the Office's current data use agreements with one or more other persons.

(b) Fulfilling the request requires unreasonable interference with the Office's regular discharge of duties.

(c) Fulfilling the request requires disclosures that violate HIPAA privacy rules (45CFR parts 160 and 164).

(d) Fulfilling the request requires disclosures that are an unreasonable invasion of privacy. If a request is denied for this reason, the burden is on the requestor to provide the Office clear and convincing evidence that fulfilling the data request is not an unreasonable invasion of privacy and that the public interest requires disclosing the requested data.

(2) Nothing in these rules authorizes the Office to disclose health data in a form that allows easy and precise identification of individual patients or individual licensed health care professionals.

Stat. Auth.: ORS 192.440 & 442.420(3)(d)
Stats. Implemented: ORS 192.410 - 192.440 & 442.420(3)(d)
Hist.: OHP 1-2007, f. 1-29-07, cert. ef. 2-1-07

The official copy of an Oregon Administrative Rule is contained in the Administrative Order filed at the Archives Division, 800 Summer St. NE, Salem, Oregon 97310. Any discrepancies with the published version are satisfied in favor of the Administrative Order. The Oregon Administrative Rules and the Oregon Bulletin are copyrighted by the Oregon Secretary of State. Terms and Conditions of Use

Oregon Secretary of State • 136 State Capitol • Salem, OR 97310-0722
Phone: (503) 986-1523 • Fax: (503) 986-1616 • oregon.sos@state.or.us

© 2013 State of Oregon All Rights Reserved​