Oregon Administrative Code

943-005-0005 Definitions (1) “Alternate format communication” means printed material converted to a style allowing individuals with disabilities to achieve effective communication. (2) “Auxiliary aids or services” mean devices or services that allow individuals with hearing, cogn…

943-005-0010 Non-Discrimination Policy (1) The Authority shall not, either directly or through another entity, discriminate against any individual, or harass, exclude from participation, or deny the benefit of programs, services or activities because the individual belongs to a p…

943-005-0015 Illegal Drug Use (1) Except as provided in OAR 943-005-0015(2), this rule does not prohibit discrimination against an individual based on that individual’s current illegal use of drugs. (2) The Authority shall not deny services to an eligible individual based on the …

943-005-0020 Reasonable Modifications (1) Unless the Authority Director or the Director’s designee determines in writing that a modification or alteration will fundamentally alter the nature or benefit of the program, service or activity, or create an undue administrative or fina…

943-005-0025 Requesting a Reasonable Modification (1) Requests for reasonable modification to a program, service, or activity may be made to Authority staff either verbally, by completing the Request for Reasonable Modification form, or in any manner otherwise acceptable to the A…

943-005-0030 Reporting Discrimination and Available Remedies (1) Any individual, or individual’s representative, who believes an individual has been discriminated against, harassed, excluded from participation or denied the benefit of programs, services, or activities because the…

943-005-0040 Request for Reconsideration (1) When the investigation of a report of discrimination or harassment is complete, the individual who filed the report of discrimination or harassment, the aggrieved individual, or the person accused of discrimination or harassment may su…

943-005-0050 Data Collection (1) OEI shall maintain records related to reports of alleged discrimination and harassment including data on the: (a) Number of reports received. (b) Types of discrimination or harassment alleged. (c) Location of the alleged discrimination. (d) Resolu…

943-005-0060 Authority Contractors and Subcontractors (1) Authority contractors and subcontractors shall: (a) Comply with all applicable state and federal statutes and rules. (b) Designate an individual to serve as the Authority contact for tracking and compliance purposes. (c) E…

943-005-0070 Implementation and Training (1) OEI shall develop a plan to communicate the Authority’s non-discrimination rules and associated policies and processes to individuals who interact with the Authority, including regular and temporary employees, volunteers, contractors a…

943-007-0001 Background Checks Employees, volunteers, providers and contractors for the Oregon Health Authority (Authority) are subject to background checks and screening to determine if they have a history of specific criminal or abusive behavior identified in federal or state l…

943-007-0501 Contesting a Final Fitness Determination (1) An SI may contest an adverse fitness determination pursuant to OAR 407-007-0320. In this rule, an adverse fitness determination includes: (a) A final fitness determination of denied or approved with restrictions pursuant t…

943-012-0005 Definitions The following definitions apply to OAR 943-012-0005 through 943-012-0025: (1) "Authority" means the Oregon Health Authority. (2) "Division" means every individual organizational unit within the Authority. (3) "Employee" means individuals acting in the cou…

943-012-0010 Prohibited Conduct (1) Conduct that may result in restriction of access includes, but is not limited to the following: (a) Causing or threatening to cause physical injury to Authority employees or visitors; (b) Engaging in actions which compromise the safety or healt…

943-012-0015 Continuation of Eligible Services (1) An individual whose access has been restricted by the Authority shall continue to be provided services for which the individual meets program eligibility requirements by an alternate and effective method of communication as deter…

943-012-0020 Notification (1) If the Authority determines that it is necessary to restrict access or the methods of communication because of prohibited conduct, the individual will be provided written notification, signed by the assistant director or deputy assistant director of …

943-012-0025 Authority Review (1) The Authority shall establish an internal review process to ensure that a notice of restriction of access is warranted prior to issuing a written notice of restriction of access. (2) Following the Authority's issuance of a notice of restriction o…

943-014-0000 Definitions The following definitions apply to OAR 943-014-0000 to 943-014-0070: (1) “Administrative Hearing” means an oral proceeding before an administrative law judge in a contested case hearing. (2) “Authority” means the Oregon Health Authority. (3) “Authority Wo…

943-014-0010 Purpose (1) The purpose of these rules (OAR 943-014-000 to 943-014-0070) is to govern the collection, use, and disclosure of protected information by the Authority about individuals and to explain the rights and specific actions that individuals may take or request t…

943-014-0015 Covered Entity Status for Purposes of the HIPAA Privacy Rules (1) These rules address information that, among other things, may be Protected Health Information that is protected by the HIPAA Privacy Rules. For purposes of HIPAA Privacy Rules, the Authority is a hybri…

943-014-0020 Uses and Disclosures of Client or Participant Protected Information (1) Uses and disclosures with individual authorization. The Authority must obtain a completed and signed authorization for release of information from the individual, or the individual’s personal rep…

943-014-0030 Client Privacy Rights (1) Rights of clients to access their information. Clients may access, inspect, and obtain a copy of information on their own cases in Authority files or records, consistent with federal and state law. (a) A client may request access by completi…

943-014-0040 Minimum Necessary Standards (1) The Authority shall limit the use and disclosure of protected information to that which is reasonably necessary to accomplish the intended purpose of the use or disclosure which is referred to in these rules as the minimum necessary st…

943-014-0060 Uses and Disclosures of Protected Information for Research Purposes The Authority may use and disclose an individual’s information for research purposes as specified in this rule. (1) All research disclosures are subject to applicable requirements of federal and stat…

943-014-0070 De-identification of Client Information and Use of Limited Data Sets under Data Use Agreements (1) The Authority may use and disclose information as appropriate for the work of the Authority, without further restriction, if the Authority or another entity has taken s…

943-014-0200 Confidentiality and Inadmissibility of Mediation Communications Pursuant to ORS 36.224(4), amending the Oregon Health Authority rule Confidentiality and Mediation Communications 943-014-0200 to adopt by reference the Confidentiality and Inadmissibility of Mediation C…

943-014-0205 Confidentiality and Inadmissibility of Workplace Interpersonal Dispute Mediation Communications Pursuant to ORS 36.224(4), adopting the Oregon Health Authority rule Confidentiality and Inadmissibility of Workplace Interpersonal Dispute Mediation Communications 943-01…

943-014-0300 Scope These rules (OAR 943-014-0300 through 943-014-0320) apply to an organization or individual seeking or receiving access to Authority information assets or network and information systems for the purpose of carrying out a business transaction between the Authorit…

943-014-0305 Definitions For purpose of these rules, the following terms have definitions set forth below. All other terms not defined in this section shall have the meaning used in the Health Insurance Portability and Accountability Act (HIPAA) security rules found at 45 CFR § 1…

943-014-0310 Information Access The organization or user shall utilize the Authority access control process for all requested and approved access. The Authority shall notify the user of each approval or denial. When approved, the Authority shall provide the user with a unique log…

943-014-0315 Security Information Assets (1) No organization or user shall access an information asset for any purpose other than that specifically authorized by the Authority access control process. (2) Except as specified or approved by the Authority, no organization or user sh…

943-014-0320 User Responsibility The organization or user shall not make any root level changes to any Authority or State of Oregon network and information system. The Authority recognizes that some application users have root level access to certain functions to allow the user t…

943-014-0400 Purpose These rules set requirements for contractors who are business associates of the health care component of the Oregon Health Authority (Authority) as described in OAR 943-014-0015. Business associates must comply with these rules, the business associate provisi…

943-014-0410 Definitions As used in OAR 943-014-0400 through 943-014-0465 the following definitions apply. Terms not defined here shall have the same meaning given those terms in the Privacy Rule and the Security Rule, 45 CFR 160 and 164. (1) “Authority” means the Oregon Health A…

943-014-0415 General Business Associate Requirements A contractor who is a business associate of the Authority shall: (1) Not use or disclose protected health information or electronic protected health information except as permitted or required by these rules and the contract, o…

943-014-0420 Uses and Disclosures of Protected Health Information by Business Associate (1) Except as otherwise limited or prohibited by the contract or these rules, a contractor who is a business associate of the Authority may: (a) Use or disclose protected health information an…

943-014-0430 Authority Obligations (1) To the extent that a business associate's use or disclosure of protected health information and electronic protected health information may be affected, the Authority shall notify business associate of: (a) Limitations in its notice of priva…

943-014-0435 Contractor Security Requirements (1) Contractors must comply with the Security Rule’s business associate requirements for electronic protected health information and must comply with both the Privacy Rule and the Security Rule requirements applicable to a business as…

943-014-0440 Breach (1) For the purposes of this rule a breach is considered “discovered” in accordance with 45 CFR 164.404(a)(2) and 45 CFR 164.410(2). (2) In the event a breach of unsecured protected health information is discovered, a contractor must: (a) Notify the Authority …

943-014-0445 Violations (1) When the Authority learns about a business associate’s failure to comply with these rules the Authority shall notify the business associate of the rule violation and provide a reasonable opportunity for the business associate to remedy or end the viola…

943-014-0450 Termination of Contract (1) Except as provided in section (2) of this rule, upon termination of the contract for any reason, the business associate shall, at the request of the Authority, return or destroy all protected health information and electronic protected hea…

943-014-0455 Order of Precedence (1) These rules shall be interpreted as broadly as necessary to implement and comply with HIPAA, the Privacy Rule, the Security Rule, and the HITECH Act. (2) Any ambiguity in these rules shall be resolved in favor of a meaning that complies and is…

943-014-0460 Authority Compliance Methods The Authority may comply with these rules: (1) By incorporating the business associate requirements contained in this rule into its contracts with business associates or by referencing these rules. (2) By entering into a memorandum of und…

943-014-0465 Standards in Individual Contracts (1) The Authority and a business associate may enter into a contract that contains more strict standards than those set forth in these rules as long as the standards do not violate the requirements of the Privacy Rule, Security Rule,…

943-045-0000 Adult Abuse Investigations, Assessing Protective Services and Review of Abuse Findings for Mental Health Services The standards and procedures for the investigation of abuse, assessment for protective services and review of abuse findings are available at OAR chapter…

943-060-0000 Application These rules (OAR 943-060-0000 to 943-060-0120) govern public contracting of the Oregon Health Authority and are subject to ORS chapters 279A, 279B, and 279C. Statutory/Other Authority: ORS 413.042 Statutes/Other Implemented: ORS 179.040, 279A.065, 413.033…

943-060-0010 Definitions Unless the context requires otherwise, the following definitions apply: (1) “Authority” means the Oregon Health Authority. (2) “Client” means any individual, family, or provider: (a) For whom the Authority provides services and incidental or specialized g…

943-060-0020 Procurement Authority (1) The Authority may enter into contracts for the planning, erection, completion, and furnishing of new buildings and additions to its institutions, and may establish contracts for goods and services of all kinds necessary for the successful ma…

943-060-0030 Contractor Requirements (1) No contract or other agreement for more than $1,000 may be entered into, renewed, or extended with any individual unless the individual certifies in writing, under penalty of perjury, that the individual is not in violation of any tax laws…

943-060-0040 Independent Contractors (1) The Authority may, within the limits of its delegation and its legislatively approved budget, contract for personal services with providers who are independent contractors. (2) “Independent contractor” means an individual who provides serv…