Or. Admin. Code § 333-025-0165

Current through Register Vol. 63, No. 12, December 1, 2024

Section 333-025-0165 - Provider Notification and Opt Out

(1) A direct provider that is a covered entity and who obtains a biological specimen or clinical individually identifiable health information from an individual must:

(a) Notify the individual or his/her personal representative, in accordance with this rule, that the individual's biological specimen or clinical individually identifiable health information may be used or disclosed for anonymous or coded research; and

(b) Give the individual the opportunity to make an opt-out statement.

(2) Any health care provider that is not described in Section (1) of this rule may, but is not required to, furnish the notification and opportunity for an opt-out statement described in Section (1) of this rule.

(3) A health care provider described in Section (1) of this rule must provide notification no later than the time required for federal privacy notices by the Federal Privacy Rule for services rendered on or after July 1, 2006 (see 45 CFR 164.520).

(4) If a health care provider is required to provide notification pursuant to Section (1) of this rule, the health care provider must provide notification at least once per individual, regardless of how many times the provider obtains the individual's biological specimen or clinical individually identifiable health information.

(5) If a health care facility provides the notice pursuant to Section (1) of this rule, a health care provider providing care to patients in the health care facility is not required to provide an additional notice with respect to services provided in the facility.

(6) Notification may be delivered in a manner determined by the health care provider within the requirements of this rule, including but not limited to any manner permitted for the provision of the notice of privacy practices required under the Federal Privacy Rule.

(7) Notification must include:

(a) A place where the individual may mark to indicate the individual's opt-out statement;

(b) A general explanation of the meaning of anonymous and coded research;

(c) A statement describing that the biological specimen or clinical individually identifiable health information may be used at some undetermined point in the future without further notice to the individual;

(d) A statement that a refusal to allow use of biological specimens or clinical individually identifiable health information will not affect access to or provision of health care by the provider originally providing notice;

(e) A statement specifying that the individual retains the right to make or revoke an opt-out statement by submitting in writing such a request to the health care provider originally providing notice;

(f) A statement indicating that an opt-out statement will be valid from the date received by the health care provider;

(g) A prominent heading indicating the purpose of the notice; and

(h) The name, or title, and telephone number or other contact information of a person or office to contact for further information.

(8) If a health care provider is required to provide notification pursuant to Section (1) of this rule, notification may be, but is not required to be, provided using the form contained in Appendix 2 of these rules.

(9) Any health care provider described by Section (1) of this rule that receives an opt-out statement of an individual must, at the time of disclosure of a biological specimen or clinical individually identifiable health information, inform the indirect provider that is the intended recipient that the individual's biological specimen or clinical individually identifiable health information is subject to an opt out statement.

(a) Methods to inform the indirect provider may include, but shall not be limited to, marking or noting the biological specimen container or clinical individually identifiable health information as subject to an opt-out statement. The mark or notation may be in any form that can be understood by the intended recipient.

(b) If an opt-out statement is received after the completion of the first service delivery and within the first fourteen (14) days from the completion of the first service delivery, a health care provider is encouraged, but is not required, to make a good faith effort to inform the indirect health care provider of the opt-out statement.

(c) Any recipient of an individual's biological specimen or clinical individually identifiable health information from a health care provider described by Section (1) of this rule that is not informed of the individual's opt-out statement within fourteen (14) calendar days of receipt may presume that the individual has not made an opt-out statement.

(10) Any health care provider subject to Section (1) of this rule must have a process in place to demonstrate compliance with this rule.

Or. Admin. Code § 333-025-0165

PH 21-2005, f. 12-30-05, cert. ef. 1-1-06

Forms and appendices referenced are available from the agency.

Stat. Auth.: ORS 192.547

Stats. Implemented: ORS 192.531 - 192.549