Or. Admin. Code § 333-333-4820

Current through Register Vol. 63, No. 12, December 1, 2024

Section 333-333-4820 - [Effective until 1/1/2025] Record Retention

(1) Licensees shall store, maintain and destroy records, including client records, in a manner that prevents unauthorized access, protects client confidentiality and prevents alteration of client records.

(a) All client records and copies of client records, including records created by facilitators, must be stored at the service center where the client participates or intends to participate in an administration session.

(b) Service centers may store electronic records on cloud-based platforms that use security measures to effectively prevent unauthorized access and protect client confidentiality. Electronic records must be accessible at the licensed premises. Electronic records stored pursuant to this subsection are considered to be stored at the service center.

(2) Unless otherwise specified in these rules, licensees must retain required records for a period of five years. For example, licensees must retain security video required by OAR 333-333-4650 for a period of 30 calendar days.

(3) Service centers must allow current and former clients to access and examine their own client records and request an addendum to those records. Following the retention period described in section (2) of this rule a service center must destroy client records upon the client's request.

(4) Service centers must allow facilitators who will provide or have provided psilocybin services at the service center to access and examine client records related to those services. Facilitators may not access the records of other clients without the client's prior written consent and may not alter the records.

(5) Licensee representatives of a service center may not access client records, without the client's prior written consent, unless doing so is necessary to support operations of the service center where the client has received or will receive psilocybin services.

(6) If a service center license is revoked, surrendered or expired the Oregon Health Authority may address in an order the manner and condition under which client records held by the licensee must be maintained, destroyed or transferred to other licensees.

Or. Admin. Code § 333-333-4820

PH 206-2022, adopt filed 12/27/2022, effective 12/27/2022; PH 58-2023, amend filed 12/21/2023, effective 1/1/2024

Statutory/Other Authority: ORS 475A.235

Statutes/Other Implemented: ORS 475A.235