Or. Admin. Code § 333-333-4810

Current through Register Vol. 63, No. 12, December 1, 2024

Section 333-333-4810 - [Effective 1/1/2025] Client Confidentiality

(1) A service center or facilitator may not disclose any information that may be used to identify a client, or disclose any communication made by a client related to psilocybin services or selling psilocybin products to a client, except with a client's consent or otherwise as allowed by ORS 475A.450. Service centers may allow facilitators to access records related to services a facilitator provided to clients at the service center without the client's consent. A licensed facilitator may only access client records for clients to whom they have provided preparation, administration, or integration sessions. A licensed facilitator may not access the client records of any other client unless the client has provided prior written consent and the facilitator accesses the records for the purpose of providing services to the client.

(2) A service center or facilitator must have a completed client consent form to disclose identifiable client information that contains the following:

(a) A specific description of the client's identifiable information to be used or disclosed.

(b) The name or specific identification of the person(s) or class of person(s) the client's information will be disclosed to.

(c) The specific purpose for which the information will be used or disclosed.

(d) The date and signature of the client.

(e) An expiration date when the consent to use or disclose is withdrawn.

(3) A service center or facilitator must use the client written consent form provided by the Oregon Health Authority (Authority) to meet the requirements of section (2) of this rule. The consent form is available on the Authority's website.

(4) If a client consents to disclose their identifiable client information the client consent form described in section (2) of this rule must be completed at least 24 hours prior to the client's administration session or at least 72 hours after the conclusion of the client's administration session. If a client chooses to withdraw their consent form described in section (2), they may do so by providing written notice to the service center or facilitator in a form and manner prescribed by the Authority.

(5) A service center or facilitator must provide a client with a disclosure form during or prior to a preparation session if the facilitator or service center intends to share de-identified data related to the client's receipt of psilocybin product or services.

(a) The disclosure form must contain:

(A) The name of the person or organization that will receive de-identified data.

(B) The specific purpose for which the de-identified data will be used or disclosed.

(C) The date the form was provided to the client and client signature acknowledging receipt.

(D) An option that allows the client to opt out of having their de-identified data disclosed to third parties.

(b) The disclosure form is not required when reporting required data to the Authority pursuant to OAR 333-333-4910 and may not be used for clients to request that their data be withheld from the Authority as described in OAR 333-333-4900(4).

(6) A service center or facilitator must use the disclosure form provided by the Authority to meet the requirements of section (5) of this rule. The disclosure form is available on the Authority's website.

(7) If a client chooses to withdraw their disclosure form described in section (5), they may do so by providing written notice to the service center or facilitator in a form and manner prescribed by the Authority.

(8) Service centers and facilitators may not alter client records after the completion of preparation, administration or integration sessions. Service centers and facilitators may create an addendum to existing records.

Or. Admin. Code § 333-333-4810

PH 206-2022, adopt filed 12/27/2022, effective 12/27/2022; PH 58-2023, amend filed 12/21/2023, effective 1/1/2024; PH 82-2024, amend filed 11/22/2024, effective 1/1/2025

Statutory/Other Authority: ORS 475A.235

Statutes/Other Implemented: ORS 475A.235, ORS 475A.450 & OL 2023, ch. 150