OAR Chapter 943 — Oregon Health Authority

Division 1 PROCEDURAL RULES

Or. Admin. R. 943-001-0000 Model Rules of Procedure

The Oregon Health Authority adopts the Attorney General Model Rules applicable to rulemaking, effective January 1, 2010, with the exception of OAR 137-001-0080.

[ED. NOTE: The full text of the Attorney General's Model Rules of Procedure is available from the office of the Attorney General or the Oregon Health Authority.]

History

Statutory/Other Authority: ORS 183.341 & 413.042
Statutes/Other Implemented: ORS 183.341 & 413.042
OHA 2-2009, f. 12-31-09, cert. ef. 1-1-10
OHA 1-2009(Temp), f. & cert. ef. 9-14-09 thru 3-12-10

Or. Admin. R. 943-001-0005 Notice of Proposed Rulemaking and Adoption of Temporary Rules

(1) Except as provided in ORS 183.335(7) or (12) or 183.341, before permanently adopting, amending, or repealing an administrative rule, the Authority shall give notice of the intended action:

(a) To legislators specified in ORS 183.335(15) at least 49 days before the effective date of the rule;

(b) To persons on the interested parties lists described in section (2) of this rule for the pertinent OAR chapter or pertinent subtopics or programs within an OAR chapter at least 28 days before the effective date of the rule;

(c) In the Secretary of State's Bulletin referred to in ORS 183.360 at least 21 days before the effective date of the rule;

(d) To other persons, agencies, or organizations that the Authority is required to provide an opportunity to comment pursuant to state statute or federal law or as a requirement of receiving federal funding, at least 28 days before the effective date of the rule;

(e) To the Associated Press and the Capitol Press Room at least 28 days before the effective date of the rule; and

(f) In addition to the above, the Authority may send notice of intended action to other persons, agencies, or organizations that the Authority , in its discretion, believes to have an interest in the subject matter of the proposed rule at least 28 days before the effective date of the rule.

(2) Pursuant to ORS 183.335(8), the Authority shall maintain an interested parties list for each OAR chapter of rules for which the Authority has administrative responsibility, and an interested parties list for subtopics or programs within those chapters. A person, group, or entity that desires to be placed on the list to receive notices regarding proposed permanent adoption, amendment, or repeal of a rule must make the request in writing or by electronic mail to the rules coordinator for the chapter. The request must include either a mailing address or an electronic mail address to which notices may be sent.

(3) Notices under this rule may be sent by hand delivery, state shuttle, postal mail, electronic mail, or facsimile. The Authority recognizes state shuttle as "mail" and may use this means to notify other state agencies.

(a) An email notification under section (1) of this rule may consist of any of the following:

(A) An email that attaches the Notice of Proposed Rulemaking or Notice of Proposed Rulemaking Hearing and Statement of Need and Fiscal Impact.

(B) An email that includes a link within the body of the email, allowing direct access online to the Notice of Proposed Rulemaking or Notice of Proposed Rulemaking Hearing and Statement of Need and Fiscal Impact.

(C) An email with specific instructions within the body of the email, usually including an electronic Universal Resource Locator (URL) address, to find the Notice of Proposed Rulemaking or Notice of Proposed Rulemaking Hearing and Statement of Need and Fiscal Impact.

(b) The Authority may use facsimile as an added means of notification, if necessary. Notification by facsimile under section (1) of this rule shall include the Notice of Proposed Rulemaking or Notice of Proposed Rulemaking Hearing and Statement of Need and Fiscal Impact, or specific instructions to locate these documents online.

(c) The Authority shall honor all written requests that notification be sent by postal mail instead of electronically if a mailing address is provided.

(4) If the Authority adopts or suspends a temporary rule, the Authority shall notify:

(a) Legislators specified in ORS 183.335(15);

(b) Persons on the interested parties list described in section (2) of this rule for the pertinent OAR chapter, subtopics, or programs within an OAR chapter;

(c) Other persons, agencies, or organizations that the Authority is required to notify pursuant to state statute or federal law or as a requirement of receiving federal funding; and

(d) The Associated Press and the Capitol Press Room; and

(e) In addition to the above, the Authority may send notice to other persons, agencies, or organizations that the Authority, in its discretion, believes to have an interest in the subject matter of the temporary rulemaking.

(5) In lieu of providing a copy of the rule or rules as proposed with the notice of intended action or notice concerning the adoption of a temporary rule, the Authority may state how and where a copy may be obtained on paper, by electronic mail, or from a specified web site.

History

Statutory/Other Authority: ORS 183.341 & 413.042
Statutes/Other Implemented: ORS 183.330, 183.335 & 183.341
OHA 1-2011, f. & cert. ef. 7-1-11

Or. Admin. R. 943-001-0007 Delegation of Rulemaking Authority

Any officer or employee of the Oregon Health Authority who is identified on a completed Delegation of Authority form signed by the Director or Deputy Director of the Authority and filed with the Secretary of State, Administrative Rules Unit, is vested with the authority to adopt, amend, repeal, or suspend administrative rules as provided on that form until the delegation is revoked by the Director or Deputy Director of the Authority, or the person leaves employment with the Authority.

History

Statutory/Other Authority: ORS 183.341 & 413.042
Statutes/Other Implemented: ORS 183.330, 183.335 & 183.341
OHA 1-2011, f. & cert. ef. 7-1-11

Or. Admin. R. 943-001-0009 Lay Representation in Contested Case Hearings

(1) Contested case hearings are conducted in accordance with the Attorney General’s model rules at OAR 137-003-0501 to 0700, except as otherwise specified in the program rules. Subject to the approval of the Attorney General, an officer or employee of the Oregon Health Authority (Authority) is authorized to appear on behalf of the agency in the following types of hearings conducted by the Authority:

(a) Eligibility and termination determinations related to medical assistance coverage.

(b) Suspension, reduction, or denial of medical assistance services, prior authorization, or medical management decisions.

(d) Eligibility for or termination of health insurance premium assistance, or determination of subsidy levels.

(e) Provider issues including provider enrollment or denial of enrollment, overpayment determinations, audits, and sanctions.

(f) Other administrative actions including criminal background checks, hardship waivers related to medical assistance, client overpayments related to medical assistance.

(g) Oregon State Hospital’s involuntary administration of a significant procedure to a patient or resident.

(h) The denial, recertification, suspension, or revocation of forensic mental health evaluator certifications.

(i) Administrative commitment and transfer extension hearings of Oregon Youth Authority youth and Oregon Department of Corrections adults-in-custody to Oregon State Hospital.

(2) The agency representative may not make legal argument on behalf of the agency.

(a) “Legal argument” includes arguments on:

(A) The jurisdiction of the agency to hear the contested case;

(B) The constitutionality of a statute or rule or the application of a constitutional requirement to an agency; and

(b) “Legal argument” does not include presentation of motions, evidence, examination and cross-examination of witnesses or presentation of factual arguments or arguments on:

(A) The application of the statutes or rules to the facts in the contested case;

(B) Comparison of prior actions of the agency in handling similar situations;

(D) The admissibility of evidence;

(E) The correctness of procedures being followed in the contested case hearing.

(3) When an agency officer or employee appears on behalf of the Authority, the administrative law judge shall advise the representative of the manner in which objections may be made and matters preserved for appeal. Such advice is of a procedural nature and does not change applicable law on waiver or the duty to make timely objection. If the administrative law judge determines that statements or objections made by an agency officer or employee involve legal argument as defined in this rule, the administrative law judge shall provide reasonable opportunity for the agency officer or employee to contact the Attorney General and permit the Attorney General to present argument at the hearing or to file written legal argument within a reasonable time after the conclusion of the hearing.

(4) An agency representative appearing under this rule must read and be familiar with the most current Code of Conduct for Non-Attorney Representatives at Administrative Hearings, which is maintained by the Oregon Department of Justice and is available on the Oregon Department of Justice website.

History

Statutory/Other Authority: ORS 413.042
Statutes/Other Implemented: ORS 183.452
OHA 1-2023, amend filed 01/13/2023, effective 01/13/2023
OHA 23-2011, f. 10-31-11, cert. ef. 11-1-11
OHA 2-2011(Temp), f. & cert. ef. 7-1-11 thru 12-27-11

Or. Admin. R. 943-001-0010 Oregon Health Authority

(1) Effective June 26, 2009, 2009 Or. Laws Chapter 595 (House Bill 2009) created the Oregon Health Authority and transferred to the Oregon Health Authority certain duties, functions, and powers of:

(a) The Department of Administrative Services (DAS) related to the Public Employees’ Benefit Board (PEBB) and the Oregon Educators Board (OEBB);

(b) The Department of Consumer and Business Services (DCBS) related to the Oregon Medical Insurance Pool Board (OMIP);

(d) The Department of Human Services (DHS) with respect to health and health care. The transferred subject areas of DHS are generally described in Section 19(1)(a), Or. Laws Chapter 595 (House Bill 2009) as including but not limited to:

(A) Developing the policies for and the provision of publicly funded medical care and medical assistance in Oregon;

(B) Ensuring the promotion and protection of public health and the licensing of health care facilities;

(D) Administering the Oregon Prescription Drug Program; and

(E) Establishing responsibility for the Office for Oregon Health Policy and Research and all functions of the office.

(2) The transferred functions described in section (1)(d)(A)–(E) above are generally carried out as currently described in DHS rules by the Public Health Division, the Addictions and Mental Health Division, and the Division of Medical Assistance Programs.

(3) As used in these rules (OAR 943-001-0000 to 943-001-0015) the term “agency” means DHS, PEBB, OEBB, OMIP, and OPHP, and within the context of transfer responsibilities, DAS and DCBS.

(4) Effective June 26, 2009, the administration of new non-transferred duties, functions, and powers established by 2009 Or. Laws, Chapter 595 (House Bill 2009), or other 2009 laws, in the Oregon Health Authority or its constituent units is temporarily delegated to the Department of Human Services, subject to the supervision and oversight of the Oregon Health Authority, until operationally transferred, either in whole or in part, to the Oregon Health Authority.

(5) Operational transfer may occur, in whole or in part, in any program, business transaction, judicial, or administrative proceeding on the date specified by the Oregon Health Authority but no later than June 30, 2011.

History

Statutory/Other Authority: ORS 413.042
Statutes/Other Implemented: ORS 413.032 - 413.037
OHA 2-2009, f. 12-31-09, cert. ef. 1-1-10
OHA 1-2009(Temp), f. & cert. ef. 9-14-09 thru 3-12-10

Or. Admin. R. 943-001-0015 Transition Period Roles and Responsibilities

(1) Effective June 26, 2009, to maintain business continuity for the duties, functions, and powers transferred to the Oregon Health Authority, the agencies listed in OAR 943-001-0010(1)(a)–(d) shall continue to exercise their former duties, functions, and powers, subject to the supervision and oversight of the Oregon Health Authority, until superseded, by operational transfer, either in whole or in part, to the Oregon Health Authority, as follows:

(a) All rules shall remain in effect and ongoing rule filing processes may continue.

(b) All program administration, policies, and procedures remain in effect and may continue to be developed and implemented.

(c) Any judicial or administrative action, proceeding, contested case hearing, or administrative review matters, or new action, proceeding, or matter involving or relating to the duties or powers transferred to the Oregon Health Authority shall continue.

(d) Rights and obligations legally incurred under contracts, leases, and business transactions shall remain legally valid.

(e) Contract, grant, and business transaction procurement and administration duties, functions, and powers shall remain in effect and may continue.

(f) Any statutory obligations for taxes, assessments, fees, charges, or payments shall continue to be paid to or reimbursed by the appropriate agency.

(g) Any former statutorily required findings, determinations, or recommendations to be made by the agencies shall continue to be made by the agencies.

(h) Any former statutorily required filings, notices or service of papers, applications, notices or other documents to be mailed, provided to, or served on the agencies shall continue to be mailed, provided to, or served on the agencies and the agencies shall retain responsibility to take any appropriate actions to protect the interests of the state concerning or arising from any filings, notices, or service.

(A) Mailing or service of notices or documents on the agencies shall be considered notice to the Oregon Health Authority. For example, any notice sent to the Department of Human Services Estate Administration Unit for purposes of ORS 113.145, 114.525 and 130.370 shall be considered notice to the Oregon Health Authority.

(B) Any filings, notices, or service made to the Oregon Health Authority may be transmitted by the Oregon Health Authority to the appropriate agency.

(2) Any and all remaining duties, functions, or powers of the agencies relating to the duties, functions, and powers transferred to the Oregon Health Authority that are not described in section (1) shall continue in effect or be exercised by the agencies until superseded by operational transfer, either in whole or in part, to the Oregon Health Authority.

History

Statutory/Other Authority: ORS 413.042
Statutes/Other Implemented: ORS 413.032 - 413.037
OHA 2-2009, f. 12-31-09, cert. ef. 1-1-10
OHA 1-2009(Temp), f. & cert. ef. 9-14-09 thru 3-12-10

Or. Admin. R. 943-001-0020 Oregon Health Authority Shared Service and Cooperative Relationships with Department of Human Services

(1) The Oregon Health Authority (Authority) will cooperate and collaborate with the Department of Human Services (Department) in order to effectively coordinate services to individuals, families and communities and realize operational efficiencies in the administration of services that are shared between them (“shared services”).

(2) For all the programs, functions, and duties with respect to health or health care (generally described in Oregon Laws 2009, chapter 595, section 19(1)(a)), transferred to the Authority from the Department (“transferred program”) or for shared services, the Authority declares that:

(a) All transferred program rules shall remain in effect until superceded by adoption of Authority rules or adoption of rules by the Authority coordinating shared services with the Department.

(b) All transferred program administration, policies, and procedures remain in effect pending the completion of review and adoption by the Authority or adoption of such policies and procedures related to coordination of shared services with the Department.

(d) Rights and obligations legally incurred under transferred program contracts, leases, and business transactions remain legally valid and are the responsibility of the Authority.

(e) Statutorily required filings, notices or service of papers, applications, notices or other documents to be mailed, provided to, or served on the Authority shall be mailed, provided to, or served on the Authority. Any notices required by ORS 113.145, 114.525, 115.003 and 130.370 to be sent to the Authority may be consolidated with similar notices to the Department and sent to the Estate Administration Unit of the Department. Any notices required by ORS 416.530 to be sent to the Authority may be consolidated with similar notices to the Department and sent to the Personal Injury Lien Unit of the Department Any consolidated notice shall be considered notice to the Authority as long as the Authority’s interest or claim in the matter is identified in the notice consistent with requirements in applicable statute.

(f) A reference to an Administrator or Assistant Director in any transferred program rule of the Authority means the Director of the Authority’s program that is covered by that chapter of the Oregon Administrative Rules or the Authority’s program specified in the rule.

(3) As the state Medicaid agency for the administration of funds from Titles XIX and XXI of the Social Security Act, the Authority is charged with the administration of the medical assistance program. The Authority is responsible for facilitating outreach and enrollment efforts to connect eligible individuals with all available publicly funded health programs.

(a) The Authority and the Department recognize that there are many points of interconnection between their programs and the individuals who receive services through these programs. In addition, there are areas of natural connection between the Authority and the Department based upon the former and current structures of the Department in the administration of the medical assistance program.

(b) The Authority shall work cooperatively with the Department in the administration of the medical assistance program and to facilitate the outreach and enrollment in the program, including making determinations of eligibility and service need for medical assistance. The Authority has designated the Department as the operating agency for home and community-based waiver services and as an Organized Health Care Delivery System.

(c) The Authority and the Department are authorized by state law to delegate to each other any duties, functions and powers that they deem necessary for the efficient and effective operation of their respective functions. The Authority and the Department will work together to adopt rules to assure that medical assistance eligibility requirements, procedures, and determinations are consistent across both agencies. The Authority has authorized the Department to determine medical eligibility for medical assistance. Where that responsibility is given to the Department under ORS Chapter 411, the Department has delegated to the Authority the duties, functions, and powers to make medical eligibility determinations in accordance with OAR 410-120-0006.

(d) Where statute establishes duties and functions of the Authority or the Department in relation to medical assistance as a public assistance program, the Authority and the Department shall cooperate in the effective administration of the program.

History

Statutory/Other Authority: ORS 413.042
Statutes/Other Implemented: ORS 413.042
OHA 6-2023, minor correction filed 07/12/2023, effective 07/12/2023
OHA 24-2011, f. 10-31-11, cert. ef. 11-1-11
OHA 3-2011(Temp), f. & cert. ef. 7-1-11 thru 12-27-11

Division 3 PUBLIC RECORD FEES

Or. Admin. R. 943-003-0000 Definitions

The following definitions apply to Oregon Administrative Rule 943-003-0010 unless otherwise indicated:

(1) "Authority" means the Oregon Health Authority.

(2) "Designee" means any officer or employee of the Authority, appointed by the Director to respond to requests for reduction or waiver of fees for public records of the Authority.

(3) "Director" means the Director of the Authority.

(4) "Person" means any natural person, corporation, partnership, firm, or association.

(5) "Photocopy(ing)" means a photograph, microphotograph and any other reproduction on paper or film in any scale, or the process of reproducing, in the form of a photocopy, a public record.

(6) "Public record" includes any writing that contains information relating to the conduct of the public's business that is prepared, owned, used or retained by the Authority regardless of physical form or characteristics.

(7) "Requestor" means a person requesting inspection, copies, or other reproduction of a public record of the Authority.

(8) "Writing" means handwriting, typewriting, printing, photographing and every means of recording, including letters, words, pictures, sounds, or symbols, or combination thereof, and all papers, maps, files, facsimiles or electronic recordings. It includes information stored on computer tape, microfiche, photographs, films, tape or videotape or that is maintained in a machine readable or electronic form.

History

Statutory/Other Authority: ORS 192.430 & 413.042
Statutes/Other Implemented: ORS192.430 & 192.440
OHA 4-2011, f. & cert. ef. 7-1-11

Or. Admin. R. 943-003-0010 Fees for Inspection or Copies of Public Records and Oregon Health Authority Publications; Other Services

(1) The Authority may charge a fee reasonably calculated to reimburse the Authority for the cost of making public records available:

(a) Costs include but are not limited to:

(A) The services and supplies used in making the records available;

(B) The time spent locating the requested records, reviewing the records, and redacting, or separating material exempt from disclosure;

(D) Copying records;

(E) Certifying copies of records;

(F) Summarizing, compiling, or organizing the public records to meet the person's request;

(G) Searching for and reviewing records even if the records subsequently are determined to be exempt from disclosure;

(H) Postal and freight charges for shipping the copies of the public records, sent first class or bulk rate based on weight;

(I) Indirect costs or third party charges associated with copying and preparing the public records; and

(J) Costs associated with electronic retrieval of records.

(b) When a Department of Justice review of the records is requested by the Authority, the Authority may charge a fee equal to the Attorney General's charge for the time spent by the attorney reviewing the public records, redacting material from the records, and segregating the public records into exempt and nonexempt records. A fee will not be charged for the cost of time spent by an attorney in determining the application of the provisions of ORS 192.410 to 192.505;

(c) Staff time shall be calculated based on the hourly rate of pay and fringe benefits for the position of the person performing the work;

(d) The cost for publications shall be based on the actual costs of development, printing, and distribution, as determined by the Authority;

(e) The cost for a public records request requiring the Authority to access the State's mainframe computer system, may include but not be limited to costs for computer usage time, data transfer costs, disk work space costs, programming, and fixed portion costs for printing and tape drive usage.

(2) The Authority shall establish a list of fees used to charge requestors for the costs of preparing and making available public records for the following:

(a) Photocopies;

(b) Facsimile copies. The Authority may limit the transmission to thirty pages;

(c) Electronic copies, diskettes, DVDs, and other electronically generated materials. The Authority shall determine what electronic media for reproduction of computer records shall be used and whether the electronic media is to be provided by the Authority or the requestor;

(d) Audio or video cassettes;

(e) Publications.

(3) The Authority shall review the list of fees established in policy from time to time in order to assure that the fees reflect current Authority costs.

(4) No additional fee shall be charged for providing records or documents in an alternative format when required by the Americans with Disabilities Act.

(5) The Authority shall notify requestors of the estimated fees for making the public records available for inspection or for providing copies to the requestor. If the estimated fees exceed $25, the Authority shall provide written notice and will not act further to respond to the request until the requestor notifies the Authority, in writing, to proceed with making the records available:

(a) The Authority may require that all or a portion of the estimated fees be paid before the Authority may proceed with making the record available;

(b) The Authority may require that actual costs of making the record available be paid before the record is made available for inspection or copies provided.

(6) The Director or designee may reduce or waive fees when a determination is made that the waiver or reduction of fees is in the public interest because making the records available primarily benefits the general public. Factors that may be taken into account in making such a determination include, but are not limited to:

(a) The overall costs to be incurred by the Authority is negligible; or

(b) Supplying the requested records or documents is within the normal scope of Authority activity; or

(d) Discovery requests made as part of pending administrative, judicial, or arbitration proceedings.

(7) If the Authority denies an initial verbal request for waiver or reduction of fees, the requestor may submit a written request. If the Authority subsequently denies the written request for a waiver or reduction of fees, the requestor may petition the Attorney General for a review of the denial pursuant to the provisions of ORS 192.440(6) and 192.450.

History

Statutory/Other Authority: ORS 192.430 & 413.042
Statutes/Other Implemented: ORS 192.430 & 192.440 and 192.450
OHA 4-2011, f. & cert. ef. 7-1-11

Division 5 INDIVIDUAL RIGHTS

Or. Admin. R. 943-005-0000 Purpose and Applicability

(1) These rules establish the Oregon Health Authority (Authority) policy of non-discrimination and a process for reporting and investigating complaints of discrimination based on protected class, in accordance with state and federal law, including but not limited to Title VI of the Civil Rights Act of 1964 (Title VI), the Americans with Disabilities Act of 1990 (ADA as amended), Section 504 of the Rehabilitation Act of 1973.

(2) These rules do not apply when the:

(a) Authority’s Office of Equity and Inclusion (OEI) has determined that the report of discrimination does not involve an allegation of discrimination based on protected class status.

(b) Allegation of discrimination based on protected class status is against an entity other than the Authority or an Authority contractor or subcontractor.

(3) OAR 943-005-0060 applies to all client service delivery contracts involving the receipt of federal funds executed or amended on or after January 1, 2015.

History

Statutory/Other Authority: ORS 413.042
Statutes/Other Implemented: ORS 413.042
OHA 3-2014, f. 9-10-14, cert. ef. 1-1-15
OHA 19-2011, f. 8-30-11, cert. ef. 9-1-11
OHA 5-2011(Temp), f. & cert. ef. 7-1-11 thru 12-27-11

Or. Admin. R. 943-005-0005 Definitions

(1) “Alternate format communication” means printed material converted to a style allowing individuals with disabilities to achieve effective communication.

(2) “Auxiliary aids or services” mean devices or services that allow individuals with hearing, cognitive or speech impairments to achieve effective communication.

(3) “Client” means any individual receiving services, seeking services or information, or who is the intended recipient of Authority services.

(4) “Contractor” means any entity with which the Authority has an agreement or contract to provide services using federal funds to clients.

(5) “Direct threat” means a significant risk to the health or safety of others. A direct threat is one that:

(a) Cannot be eliminated or reduced to an acceptable level through the provision of auxiliary aids or services or through reasonably modifying policies, practices or processes.

(b) Is identified through an individual assessment that relies on current medical evidence, or the best available objective evidence that shows:

(A) The nature, duration and severity of the risk;

(B) The probability that a potential injury will actually occur; and

(6) “Discrimination” means the denial of services to individuals or groups because the individual or group is part of a protected class. It includes policy, practice or treatment resulting in unequal access to Authority programs and services, or having a disparate impact on a protected class.

(7) “Good cause” exists when an action, delay, or failure to act arises from an excusable mistake, surprise, excusable neglect, or the reasonable reliance on the statement of a party, Authority contractor, subcontractor or agency representative.

(8) “Harassment” means unwelcome, unwanted or offensive conduct directed at an individual based on the individual’s protected class status.

(9) “Individual with a disability” means an individual who:

(a) Has a physical or mental impairment that substantially limits one or more major life activities; or

(b) Has a record or history of such an impairment; or

(10) "Protected class" means a group of people protected from discrimination by law, on the basis of sexual orientation, race, color, national origin, religion, disability, age, sex (includes pregnancy-related conditions and sexual harassment), marital or familial status, or other class protected by law.

(11) “Qualified individual with a disability” means an individual who can meet the essential eligibility requirements for a program, service or activity with or without reasonable modification of rules, policies or processes, or the provision of auxiliary aids or services.

(12) “Reasonable modifications” means a modification of policies, practices, or processes made to a program or service that allows an individual with a disability to participate equally in the program or benefit from the program or service.

(13) “Sexual orientation” means an individual’s actual or perceived heterosexuality, homosexuality, bisexuality or gender identity, regardless of whether the individual’s gender identity, appearance, expression or behavior differs from that traditionally associated with the individual’s sex at birth.

(14) “Subcontractor” means any entity or agent who enters into an agreement with an Authority contractor to perform part or all of the obligations of the contractor who has a contract with the Authority funded in whole or part with federal funds.

History

Statutory/Other Authority: ORS 413.042
Statutes/Other Implemented: ORS 413.042
OHA 3-2014, f. 9-10-14, cert. ef. 1-1-15
OHA 19-2011, f. 8-30-11, cert. ef. 9-1-11
OHA 5-2011(Temp), f. & cert. ef. 7-1-11 thru 12-27-11

Or. Admin. R. 943-005-0010 Non-Discrimination Policy

(1) The Authority shall not, either directly or through another entity, discriminate against any individual, or harass, exclude from participation, or deny the benefit of programs, services or activities because the individual belongs to a protected class.

(2) The Authority shall not discriminate against an individual in the granting of licenses and certificates because the individual is part of a protected class.

(3) The Authority shall not apply criteria, standards, or practices that screen out or tend to screen out individuals in a protected class from fully and equally enjoying any goods, programs, services, or activities unless:

(a) The criteria can be shown to be necessary for providing those goods, programs, services or activities; or

(b) The Authority determines the screening or exclusion identifies a direct threat to the health or safety of others.

(4) The Authority shall provide programs, services, and activities in the most integrated setting possible to meet the needs of individuals within the context of the program, service, or activity.

(5) The Authority shall not require an individual to participate in programs, services, or activities that are separate or different, despite the existence of permissibly separate or different programs or activities.

(6) The Authority shall ensure each program, service, or activity, including public meetings, hearings and events, are usable by all individuals. This includes respecting the individual’s dignity by providing individuals with disabilities the ability to safely approach, enter, operate, and participate in the program, service, or activity with or without reasonable modifications.

(7) The Authority shall ensure each program, service, or activity provides individuals with the opportunity to access translation, oral and sign language interpreters, auxiliary aids or services and other alternative methods of communications, including help for non-English speaking individuals and limited English proficiency (LEP) persons.

(8) The Authority shall take appropriate steps to ensure that communications with applicants, participants, and members of the public with disabilities are as effective as communications with others.

(9) The Authority shall not deny individuals the opportunity to participate on planning or advisory boards based on the individual’s protected class.

(10) The Authority shall not discriminate against individuals due to their relationship or association with one or more individuals in a protected class.

(11) The Authority shall not retaliate against any individual filing a report of discrimination or harassment.

(12) The Authority shall comply with the following statutes and regulations:

(a) Title VI of the Civil Rights Act of 1964 prohibiting discrimination in the delivery of services based on race, color or national origin (42 USC §2000d), and the United States Department of Justice (DOJ) implementing regulations at 28 C.F.R. Part 42, Subpart C.

(b) The Omnibus Crime Control and Safe Streets Act of 1968, prohibiting discrimination in the delivery of services based on race, color, national origin, religion, or sex (42 U.S.C. § 3789d(c) (1)), and the DOJ implementing regulations at 28 C.F.R. Part 42, Subpart D.

(c) Guidance to Federal Financial Assistance Recipients Regarding Title VI Prohibition Against National Origin Discrimination Affecting Limited English Proficient Persons at 67 Fed. Reg. 41455 (June 18, 2002), addressing the obligation of recipients to take reasonable steps to provide meaningful access to funded programs and activities to those persons who may be limited English proficient (LEP), pursuant to Title VI and the Safe Streets Act.

(d) Section 504 of the Rehabilitation Act of 1973, prohibiting discrimination in the delivery of services based on disability (29 U.S.C. § 794), and the DOJ implementing regulations at 28 C.F.R. Part 42, Subpart G.

(e) Title II of the Americans with Disabilities Act of 1990 (as amended), prohibiting discrimination in the delivery of services based on disability (42 U.S.C. § 12132), and the DOJ implementing regulations at 28 C.F.R. Part 35.

(f) Title III of the Americans with Disabilities Act of 1990 (as amended), prohibiting discrimination in places of public accommodation based on disability (42 U.S.C. § 12182), and the DOJ implementing regulations at 28 C.F.R. Part 36.

(g) Title IX of the Education Amendments of 1972, prohibiting discrimination in educational services based on sex (20 U.S.C. § 1681), and the DOJ implementing regulations at 28 C.F.R. Part 54.

(h) The Age Discrimination Act of 1975, prohibiting discrimination in the delivery of services based on age (42 U.S.C. § 6102), and the DOJ implementing regulations at 28 C.F.R. Part 42, Subpart I.

(i) Executive Order 13279 and the DOJ regulations on the Equal Treatment for Faith-Based Organizations, prohibiting discrimination in the delivery of services based on religion and prohibiting the use of federal funding for inherently religious activities (28 C.F.R. Part 38(i)).

(j) Section 1557 of the Patient Protection and Affordable Care Act of 2010, prohibiting discrimination in the delivery of services in health care programs or activities based on race, color, national origin, sex, sex stereotypes, gender identity, age or disability.

(k) Oregon Revised Statute 659A.403, prohibiting discrimination in places of public accommodation based on race, color, religion, sex, sexual orientation, national origin, marital status or age if the individual is 18 years of age or older.

(l) Oregon Revised Statute 659A.103, prohibiting discrimination on the basis of disability.

(m) All other applicable state or federal laws.

History

Statutory/Other Authority: ORS 413.042
Statutes/Other Implemented: ORS 413.042
OHA 3-2014, f. 9-10-14, cert. ef. 1-1-15
OHA 19-2011, f. 8-30-11, cert. ef. 9-1-11
OHA 5-2011(Temp), f. & cert. ef. 7-1-11 thru 12-27-11

Or. Admin. R. 943-005-0015 Illegal Drug Use

(1) Except as provided in OAR 943-005-0015(2), this rule does not prohibit discrimination against an individual based on that individual’s current illegal use of drugs.

(2) The Authority shall not deny services to an eligible individual based on the individual’s current illegal use of drugs when the requested or provided services are in connection with drug rehabilitation or other health services related to the individual’s current illegal use of drugs.

(3) A drug rehabilitation or treatment program may deny participation to an individual who engages in illegal use of drugs while that individual is in the program.

(4) A program may adopt reasonable drug testing policies designed to ensure that an individual who has illegally used drugs in the past is not now using drugs illegally.

(5) A psychoactive substance use disorder resulting from current illegal use of drugs is not a disability under these rules.

History

Statutory/Other Authority: ORS 413.042
Statutes/Other Implemented: ORS 413.042
OHA 3-2014, f. 9-10-14, cert. ef. 1-1-15
OHA 19-2011, f. 8-30-11, cert. ef. 9-1-11
OHA 5-2011(Temp), f. & cert. ef. 7-1-11 thru 12-27-11

Or. Admin. R. 943-005-0020 Reasonable Modifications

(1) Unless the Authority Director or the Director’s designee determines in writing that a modification or alteration will fundamentally alter the nature or benefit of the program, service or activity, or create an undue administrative or financial burden, the Authority shall:

(a) Make reasonable modifications to the policies, practices or processes of a program, service or activity when the modifications are necessary to avoid discrimination based on disability.

(b) Provide aids and services or alternate format communications to individuals with disabilities where necessary to ensure an equal opportunity to participate in, and enjoy the benefits of a program, service, or activity.

(2) The Authority shall decide which aid, service or format may be provided without fundamental alteration or undue burden, but shall consider first the choice of the requester.

(a) Except as authorized under specific programs, the Authority is not required to provide personal devices, individually prescribed devices, readers for personal use or study, or services of a personal nature.

(b) The Authority shall not assess a charge or fee to an individual with a disability or any group of individuals with disabilities to cover the costs of measures required to provide the individual with a reasonable modification.

History

Statutory/Other Authority: ORS 413.042
Statutes/Other Implemented: ORS 413.042
OHA 3-2014, f. 9-10-14, cert. ef. 1-1-15
OHA 19-2011, f. 8-30-11, cert. ef. 9-1-11
OHA 5-2011(Temp), f. & cert. ef. 7-1-11 thru 12-27-11

Or. Admin. R. 943-005-0025 Requesting a Reasonable Modification

(1) Requests for reasonable modification to a program, service, or activity may be made to Authority staff either verbally, by completing the Request for Reasonable Modification form, or in any manner otherwise acceptable to the Authority.

(2) When the Authority receives a request for reasonable modification, the Authority shall:

(a) Make a determination about any additional documentation needed and request the documentation.

(b) Communicate with the individual requesting the reasonable modification about the process, additional required documentation and the possibility of acceptable alternate modifications.

(c) Authority staff shall consider the requester a partner, communicating routinely and respectfully in an effort to achieve a swift and satisfactory resolution to requests for reasonable modification.

(3) When a request for reasonable modification is related to an event or activity that is fixed in time, such as a public meeting, Authority staff shall make a decision as soon as reasonably possible, and in no case less than eight hours prior to the event or activity, provided the request is received at least 12 hours prior to the event or activity.

(4) No more than 15 days after receiving a request or any additional required documentation, whichever is later, the Authority shall notify the requester in writing that the requested modification was approved, approved with alternate modification, or denied.

(a) Notification related to a request for reasonable modification approved with alternate modifications or denied shall be clearly labeled “Preliminary Notification Subject to Review”.

(b) The Authority shall ensure the approved modification occurs within a reasonable time.

(5) The Authority’s ADA Coordinator shall review all preliminary notifications.

(6) An individual or the individual’s representative may request a review meeting with the ADA Coordinator after receiving a preliminary notification approving alternate modifications or denying modifications.

(a) If a review meeting is not requested within 60 days of the preliminary notification, the decision shall become final.

(b) Within 15 days of receiving a request for a review meeting, the ADA Coordinator will meet with the individual or the individual’s representative and attempt to resolve the individual’s concerns.

(c) Within 15 days of the review meeting, the ADA Coordinator will respond in writing and shall notify the requestor of the final result of the review.

(7) An individual whose request for reasonable modification has been denied or approved with an alternate modification that the individual believes to be inadequate may file:

(a) A report of discrimination as described in these rules; or

(b) A complaint with the appropriate federal or state regulatory agency.

(8) The Authority shall retain all written requests for meetings with the ADA Coordinator for at least three years.

History

Statutory/Other Authority: ORS 413.042
Statutes/Other Implemented: ORS 413.042
OHA 3-2014, f. 9-10-14, cert. ef. 1-1-15
OHA 19-2011, f. 8-30-11, cert. ef. 9-1-11
OHA 5-2011(Temp), f. & cert. ef. 7-1-11 thru 12-27-11

Or. Admin. R. 943-005-0030 Reporting Discrimination and Available Remedies

(1) Any individual, or individual’s representative, who believes an individual has been discriminated against, harassed, excluded from participation or denied the benefit of programs, services, or activities because the individual is a member of a protected class may file a report of discrimination based on protected class.

(a) The Authority shall accept anonymous reports and investigate them to the extent possible.

(b) The Authority shall maintain confidentiality when conducting investigations to the extent possible.

(c) The Authority shall ask the reporter or affected individual to sign a release of information indicating authorization for the Authority to access information to assist the investigation.

(2) The Authority shall accept a report of discrimination based on a request for reasonable modification only if:

(a) The request for reasonable modification, including requests for auxiliary aids or services, an interpreter, or an alternate format communication, was made as provided for in these rules; and

(b) The final result under these rules was a denial or provision of an alternate modification that the requester believes to be inadequate.

(3) A report of discrimination shall be filed within 180 days of the date of the alleged discrimination unless good cause exists for the delay in reporting.

(4) The Authority shall accept a report of discrimination on the Authority’s form, in a verbal report or in any other format that contains enough information to allow the Authority to investigate the report.

(a) A report of discrimination may be submitted to any Authority office, in person, by phone, fax or electronically.

(b) Any Authority employee who receives a report of discrimination based on protected class shall notify OEI in accordance with approved Authority policies and processes.

(5) A complete report of discrimination includes:

(a) The name of all parties involved, including any witnesses.

(b) A specific and detailed description of the conduct or action that the individual believes is discriminatory or harassing.

(c) The name and location of the building or facility the individual was unable to access or the program, service, or activity in which the individual was denied participation.

(d) The date or time period in which the discrimination or harassment occurred.

(e) A description of the remedy the client or the individual filing the report desires.

(f) A statement of good cause that justifies waiving the time limit, if more than 180 days have passed since the discrimination or harassment occurred.

(6) Authority staff shall assist reporters and make every effort to obtain a complete report.

(7) The Authority shall investigate all reports of discrimination to the fullest extent possible.

(a) All investigations shall include an interview with the individual filing the report, when that individual is known.

(b) All Authority employees shall fully cooperate with investigations.

(8) The Authority shall provide as requested, at no cost to the parties, reasonable modifications or alternate means of participation in order to aid the investigation. Such modifications or alternate means include but are not limited to the provision of an interpreter or written material in large print.

(9) Within seven days of receiving a report of discrimination based on protected class, the Authority shall provide written notification to:

(a) The individual who was allegedly discriminated against or harassed, the individual’s representative, or the reporter, if different.

(b) The alleged perpetrator in accordance with the respective collective bargaining agreements and related state policies.

(10) When the investigation is complete, the Authority shall provide written notification to the:

(a) Individual who filed the report.

(b) Individual who was allegedly discriminated against or harassed, or the individual’s representative, if different from (a).

(11) The closing notice shall include, as appropriate:

(a) The findings of the investigation.

(b) An explanation about the process and timelines for a request for reconsideration.

(12) When the Authority substantiates a report of discrimination or harassment, the Authority shall take prompt and appropriate action in accordance with policy, contracts, and collective bargaining agreements.

(13) Authority employees who violate these rules may be subject to disciplinary action up to and including termination from state service.

(14) The remedies provided under these rules are in addition to other remedies available under state or federal rule or law, except where exhaustion of these remedies is a requirement of seeking remedies in another forum.

(15) The Authority shall make available:

(a) Information about an individual’s right to file a complaint with the other entities, including the U.S. Department of Justice (USDOJ), U.S. Department of Health and Human Services Office of Civil Rights (OCR), and the Oregon Bureau of Labor and Industries (BOLI); and

(b) Applicable timelines for reporting complaints of discrimination and harassment with other entities.

(16) These rules and remedies do not create a contested case subject to judicial review.

History

Statutory/Other Authority: ORS 413.042
Statutes/Other Implemented: ORS 413.042
OHA 3-2014, f. 9-10-14, cert. ef. 1-1-15
OHA 19-2011, f. 8-30-11, cert. ef. 9-1-11
OHA 5-2011(Temp), f. & cert. ef. 7-1-11 thru 12-27-11

Or. Admin. R. 943-005-0040 Request for Reconsideration

(1) When the investigation of a report of discrimination or harassment is complete, the individual who filed the report of discrimination or harassment, the aggrieved individual, or the person accused of discrimination or harassment may submit a written request for reconsideration within 20 days of the date the closing notice is issued.

(2) Written requests for reconsideration must be dated and submitted to the Authority’s Director’s Office.

(3) The Director or Director’s designee shall issue a final written response to the request for reconsideration.

History

Statutory/Other Authority: ORS 413.042
Statutes/Other Implemented: ORS 413.042
OHA 3-2014, f. 9-10-14, cert. ef. 1-1-15

Or. Admin. R. 943-005-0050 Data Collection

(1) OEI shall maintain records related to reports of alleged discrimination and harassment including data on the:

(a) Number of reports received.

(b) Types of discrimination or harassment alleged.

(d) Resolution status of individual reports.

(e) Number of requests for reconsideration.

(2) OEI shall establish reporting standards for designees.

(3) OEI shall retain all collected reporting records for at least three years.

History

Statutory/Other Authority: ORS 413.042
Statutes/Other Implemented: ORS 413.042
OHA 3-2014, f. 9-10-14, cert. ef. 1-1-15

Or. Admin. R. 943-005-0060 Authority Contractors and Subcontractors

(1) Authority contractors and subcontractors shall:

(a) Comply with all applicable state and federal statutes and rules.

(b) Designate an individual to serve as the Authority contact for tracking and compliance purposes.

(d) Establish written processes for documenting and resolving reports of discrimination, harassment, and requests for reasonable modification.

(e) Provide a copy of their non-discrimination policies and processes to OEI upon request.

(f) Maintain records related to reports of alleged discrimination and harassment substantially similar to the data collection requirements established by these rules and provide them to the Authority upon request.

(g) Retain these records for at least three years.

(2) Authority contractors or subcontractors with 15 or more employees shall designate at least one person to coordinate its efforts to adopt grievance procedures.

(3) The name and contact information of the coordinator shall be communicated to individuals requesting information, or applying for or receiving the benefit of programs, services, or activities in handbooks and other general information materials, including but not limited to appropriate websites and publications.

(4) Contractor and subcontractor grievance procedures shall:

(a) Incorporate appropriate due process standards.

(b) Provide for the prompt and equitable resolution of complaints alleging discrimination or harassment based on protected class.

(5) Authority contractors and subcontractors shall provide timely and meaningful notice to individuals about the:

(a) Contractor’s or subcontractor’s non-discrimination policies and processes;

(b) Individual’s right to file a complaint with the Authority, U.S. Department of Justice (USDOJ), U.S. Department of Health and Human Services Office of Civil Rights (OCR), and the Oregon Bureau of Labor and Industries (BOLI); and

(c) Applicable timelines for reporting complaints of discrimination and harassment with the Authority, USDOJ, OCR and BOLI.

(6) Authority contractors and subcontractors shall include the information required by this rule in handbooks and other general information materials including but not limited to appropriate websites and publications provided to individuals requesting information, or applying for or receiving the benefit of programs, services, or activities.

(7) If the Authority receives a report of discrimination or harassment involving the conduct of an Authority contractor or subcontractor:

(a) The Authority shall inform the Authority contractor or subcontractor of the report.

(b) The Authority contractor or subcontractor shall:

(A) Cooperate with the Authority’s investigative process;

(B) Take prompt and appropriate action consistent with this rule, Authority contracts, and all applicable Authority administrative rules, policies and processes.

(8) Authority contractors who violate these rules may be subject to action including, but not limited to requests to cure, implementation of compliance work plans, contract amendments, or termination and non-renewal of contract.

History

Statutory/Other Authority: ORS 413.042
Statutes/Other Implemented: ORS 413.042
OHA 3-2014, f. 9-10-14, cert. ef. 1-1-15

Or. Admin. R. 943-005-0070 Implementation and Training

(1) OEI shall develop a plan to communicate the Authority’s non-discrimination rules and associated policies and processes to individuals who interact with the Authority, including regular and temporary employees, volunteers, contractors and subcontractors and clients.

(2) OEI shall coordinate the Authority’s civil rights compliance activities.

(3) All Authority employees shall receive training regarding this policy that includes:

(a) Information about where to find these rules and associated policies; and

(b) An opportunity to ask questions and have their questions answered.

(4) OEI shall work collaboratively within the Authority to:

(a) Bring existing processes into compliance with this rule and Authority policy.

(b) Increase uniformity within Authority programs in policy and processes related to civil rights violations and investigations.

(d) Ensure uniformity in tracking and compiling data related to civil rights complaints and violations.

(e) Communicate the Authority’s non-discrimination rules, policies, and processes in handbooks and other general information materials to individuals requesting information, or applying for or receiving the benefit of programs, services, or activities.

(5) The Authority shall provide contractors and subcontractors with communication and training materials developed as a part of the implementation of these rules.

History

Statutory/Other Authority: ORS 413.042
Statutes/Other Implemented: ORS 413.042
OHA 3-2014, f. 9-10-14, cert. ef. 1-1-15

Division 7 CRIMINAL HISTORY CHECKS

Or. Admin. R. 943-007-0001 Background Checks

Employees, volunteers, providers and contractors for the Oregon Health Authority (Authority) are subject to background checks and screening to determine if they have a history of specific criminal or abusive behavior identified in federal or state law or rules such that they should not be allowed to work, volunteer, be employed, or otherwise perform in positions covered by these rules.

(1) The Authority adopts and incorporates by reference the rules established in: OAR 407-007-0000 to 0075 and 407-007-0090 to 0100 (Employees, Volunteers and Contractors) for those matters that involve employees, volunteers, or contractors of the Authority, except as otherwise provided in this rule.

(2) The Authority adopts and incorporates by reference the rules established in: OAR 407-007-0200 to 407-007- 0320; and 407-007-0340 to 407-007-0370 (Providers) for those matters that involve any entity or agency licensed, certified, registered, or otherwise regulated by the Authority, except as otherwise provided in this rule.

(3) The Authority adopts and incorporates by reference the rules established in OAR 407-007-0400 to 407-007-0460 for those matters that involve abuse checks for Authority employees, volunteers, and applicants for employment or volunteer positions, except as otherwise provided in this rule.

(4) The Authority adopts and incorporates by reference the rules established in OAR 407-007-0600 to 407-007-0640 (Long Term Care Registry) for those matters that involve any entity or agency licensed, certified, registered, or otherwise regulated by the Authority, except as otherwise provided in this rule.

(5) Any reference to any rule from OAR 407-007-0000 to 407-007-0100 or from 407-007-0400 to 407-007-0640 in rules or contracts of the Authority are deemed to be references to the requirements of this rule, and shall be construed to apply to employees, volunteers, or contractors of the Authority.

(6) References in OAR 407-007-0000 to 407-007-0640 to the Department of Human Services (Department) or to the Authority shall be construed to be references to either or both agencies.

(7) The Authority authorizes the Department to act on its behalf in carrying out background checks and screening associated with the administration of programs or activities administered by the Authority.

History

Statutory/Other Authority: ORS 413.042, 181A.195, 181A.200 & 413.036
Statutes/Other Implemented: ORS 183.341, 413.036 & 443.004
OHA 1-2020, amend filed 02/10/2020, effective 02/10/2020
OHA 1-2019, amend filed 10/01/2019, effective 10/01/2019
OHA 1-2018, temporary amend filed 07/02/2018, effective 07/02/2018 through 12/27/2018
OHA 6-2012, f. 8-9-12, cert. ef. 8-10-12
OHA 2-2012(Temp), f. & cert. ef. 5-7-12 thru 11-2-12

Or. Admin. R. 943-007-0501 Contesting a Final Fitness Determination

(1) An SI may contest an adverse fitness determination pursuant to OAR 407-007-0320. In this rule, an adverse fitness determination includes:

(a) A final fitness determination of denied or approved with restrictions pursuant to OAR 407-007-0320; or

(b) A mandatory exclusion pursuant to federal law and OAR 407-007-0279 if hearing rights are allowed by federal law.

(2) An SI who is already employed by the Authority at the time of the final fitness determination may appeal through applicable personnel rules, policies, and collective bargaining provisions. The SI’s decision to do so is an election of remedies as to the rights of the SI with respect to the fitness determination and constitutes a waiver of the contested case process described in this rule.

(3) The appeal process is conducted in accordance with OAR 125-007-0300, ORS 183.411 to 183.497, and the Attorney General’s Uniform and Model Rules of Procedure for the Office of Administrative Hearings (OAH), OAR 137-003-0501 to 137-003-0700.

(4) During the appeal process, the final fitness determination remains in effect.

(a) If an SI is denied or mandatorily excluded, the SI may not work, volunteer, be employed, hold the position, provide services or be employed, licensed, certified, or registered or otherwise perform in positions covered by these rules.

(b) If an SI has an approval with restrictions, the SI may only work under the terms of the restriction listed on the notice of final fitness determination.

(5) A positive change does not guarantee employment or placement. A positive change is either:

(a) A denial changing to an approval or an approval with restrictions; or

(b) An approval with restrictions changing to an approval.

(6) An SI may represent him or herself or have legal representation during the appeal process. For the purpose of this rule, the term “SI” shall be considered to include the SI’s legal representative if the SI has provided the Authority with such information.

(a) An SI appealing an adverse outcome regarding the position of personal support worker as defined in ORS 410.600 may be represented by a labor union representative pursuant to ORS 183.459.

(b) If the SI is a member of a bargaining unit, the SI may be represented by the certified or recognized exclusive representative of the bargaining unit.

(7) A hearing representative may represent the Authority in contested case hearings. Alternatively, the Authority may be represented by the Office of the Attorney General.

(8) Any contested case hearing request must be received by the Authority by 11:59 p.m. on the due date, or if mailed, postmarked by 11:59 p.m. on the due date.

(a) To request a contested case hearing the SI must complete, sign and date the Hearing Request form.

(b) The completed and signed form must be received by the Department on or before the due date. The due date is 30 calendar days after the effective date of action on the notice of fitness determination.

(c) If a contested case hearing request for hearing is not timely, the Authority shall determine, based on a written statement from the SI and available information, if there is good cause to proceed with the appeal process.

(d) The Authority may refer an untimely request to OAH for a contested case hearing solely on the issue of timeliness of the contested case hearing request.

(9) After the Authority receives the SI’s request for a contested case hearing, the Authority may conduct an administrative review before referring the appeal to OAH.

(a) The administrative review is not open to the public.

(b) The SI must participate in the administrative review.

(c) In addition to any other method of communication, the Authority shall provide the SI with written correspondence that initiates the administrative review process (“Correspondence”).

(d) The Correspondence shall include a due date for the SI. Any response to the Authority’s Correspondence must be received by the Authority by 11:59 p.m. on the due date, or if mailed, postmarked by 11:59 p.m. on the due date.

(e) Participation by the SI may include but is not limited to providing additional information or additional documents requested on or before the due date specified in the Authority’s Correspondence.

(f) For the purposes of this rule, failure to participate in the administrative review means that the SI does not respond in any way to the Authority’s Correspondence by the specified due date. Failure to participate in the administrative review process shall result in a dismissal order pursuant to paragraph (13)(b)(C) of this rule.

(g) The outcome of an administrative review is a new fitness determination.

(A) If the hearing representative makes a positive change to approved, BCU shall issue a final order and an amended notice to the SI and the QE.

(B) If the hearing representative makes a positive change from denial to approval with restrictions, the Authority shall issue an amended notice to the SI and the QE. If the SI does not continue with to a contested case hearing, the Authority shall issue a final order as an amended notice of fitness determination to the SI and the QE.

(C) If the hearing representative maintains the outcome of the final fitness determination, or changes an approval with restrictions to a denial, the Authority will refer the contested case hearing request to OAH.

(10) The SI may not challenge a finding of substantiated abuse or criminal conviction that was a basis for the adverse outcome under this rule. The SI has the right to contest the weight the Authority has given to:

(a) The evidence;

(b) The factors used in the weighing test; or

(11) The Authority may conduct additional research, including abuse checks or criminal records checks (if allowed by law) during the appeal process to update or verify the SI’s potentially disqualifying convictions or conditions and factors to consider in the weighing test. If needed, the Authority may amend the notice of fitness determination during the appeal process while still maintaining the original hearing rights and deadlines.

(12) An administrative law judge from OAH conducts the contested case hearing.

(a) The contested case hearing is not open to the public.

(b) The Authority shall provide the administrative law judge and the SI a complete copy of available information used during the criminal records checks and fitness determinations. The SI is entitled to reasonable notice of all hearing documents through proper service.

(c) SIs may not have access to confidential information contained in records collected or developed during the criminal records check process without a protective order limiting further disclosure of the information.

(A) The Authority must request a protective order by motion to an administrative law judge as provided for in OAR 137-003-0570(8) or by a court of law.

(B) In conjunction with a protective order issued pursuant to this section, individually identifying information relating to clients, witnesses, and other persons identified in abuse investigation reports or other records collected or developed during the criminal records check process shall be redacted prior to disclosure, except for the information identifying the SI.

(d) The administrative law judge shall make a new final fitness determination based on the evidence and the contested case hearing record.

(e) The only remedy that an administrative law judge may grant is a fitness determination that the SI is approved, approved with restrictions (if allowed by rule), or denied.

(f) Under no circumstances shall the Authority or Qualified Entity (QE) be required to place an SI in any position, nor shall the Authority or QE be required to accept services or enter into a contractual agreement with an SI.

(13) The result of an appeal is a final order.

(a) In the following situations, notice of fitness determination becomes the final order as if the SI never requested a hearing in the following situations:

(A) The SI failed to request a hearing in the time allotted in this rule. No other document shall be issued after the notice of fitness determination.

(B) The SI withdraws the request for hearing at any time during the appeal process.

(b) The Authority shall issue an order dismissing the appeal (a “dismissal order”) in the following situations:

(A) The Authority shall dismiss a contested case hearing request if the administrative review results in a positive outcome. The only exception to the Authority issuing a dismissal order is when the SI proceeds to contested case hearing because the administrative review changed fitness determination from denial to approval with restrictions.

(B) The SI may withdraw a hearing request verbally or in writing at any time before the issuance of a final order. A dismissal order due to the withdrawal is effective the date the withdrawal is received by the Authority or OAH. The SI may cancel the withdrawal in writing within 14 calendar days after the date of withdrawal.

(C) The Authority shall dismiss a hearing request when the SI fails to participate in the administrative review. Failure to participate as defined in (8)(f) of this rule shall result in termination of hearing rights through a dismissal order.

(i) The dismissal order is effective on the date the Authority mails the dismissal order.

(ii) The Authority shall review a good cause request to reinstate hearing rights if received in writing by the Authority within 14 calendar days.

(A) If no written exceptions are received by the Authority within 14 calendar days after the service of the proposed and final order, the proposed and final order shall become the final order.

(B) If timely written exceptions to the proposed and final order are received by the Authority, the Authority’s ’s Director or designee shall consider the exceptions and serve a final order or request a written response or a revised proposed and final order from the administrative law judge.

(14) Final orders, including dismissal and default orders, are subject to reconsideration or rehearing petitions within 60 calendar days after the final order is served, pursuant to OAR 137-003-0675.

History

Statutory/Other Authority: ORS 181.534, 181.537 & 413.042
Statutes/Other Implemented: ORS 181.534, 181.537 & 183.341
OHA 1-2020, amend filed 02/10/2020, effective 02/10/2020
OHA 1-2018, temporary amend filed 07/02/2018, effective 07/02/2018 through 12/27/2018
OHA 6-2012, f. 8-9-12, cert. ef. 8-10-12
OHA 2-2012(Temp), f. & cert. ef. 5-7-12 thru 11-2-12

Division 12 RESTRICTING ACCESS TO OREGON HEALTH AUTHORITY PREMISES AND EMPLOYEES

Or. Admin. R. 943-012-0005 Definitions

The following definitions apply to OAR 943-012-0005 through 943-012-0025:

(1) "Authority" means the Oregon Health Authority.

(2) "Division" means every individual organizational unit within the Authority.

(3) "Employee" means individuals acting in the course and scope of their duties who are on the State of Oregon payroll, contract employees, employees of temporary service agencies, and volunteers. It also includes employees of other government or social service agencies who, at the time they are accompanying an Authority employee on Authority business, are the target of conduct described in OAR 943-012-0010.

(4) "Premises" means any land, building, facility, and other property owned, leased, or in the possession of, and used or controlled by the Authority. When the Authority occupies space in a building occupied by multiple tenants, the definition includes the common areas of the building used by all tenants such as, but not limited to, restrooms, hallways, and food service areas.

(5) "Restriction of Access" means the Authority has limited an individual's access to specific Authority premises, employees, or methods of communication.

(6) "Weapon" includes, but is not limited to:

(a) A dangerous or deadly weapon as defined in ORS 161.015;

(b) Any other object or substance used in a manner that compromises the safety of Authority employees or visitors on Authority premises;

History

Statutory/Other Authority: ORS 413.042
Statutes/Other Implemented: ORS 413.042 & 654.010
OHA 18-2011, f. 8-30-11, cert. ef. 9-1-11
OHA 7-2011(Temp), f. & cert. ef. 7-1-11 thru 12-27-11

Or. Admin. R. 943-012-0010 Prohibited Conduct

(1) Conduct that may result in restriction of access includes, but is not limited to the following:

(a) Causing or threatening to cause physical injury to Authority employees or visitors;

(b) Engaging in actions which compromise the safety or health of Authority employees or visitors;

(c) Causing or threatening to cause harm to the family or property of an employee or visitors through written, electronic, or verbal communication;

(d) Causing or threatening to cause damage to Authority premises;

(e) Bringing a deadly or dangerous weapon onto the Authority's premises, unless authorized by ORS chapter 166 to carry a handgun;

(f) Displaying, attempting, or threatening to use any weapon, on or off Authority premises, that compromises the safety of Authority employees or visitors;

(g) Engaging in harassing conduct as defined in ORS 166.065.

(h) Engaging in telephonic harassment as defined in ORS 166.090.

(2) The conduct listed in section (1) is also prohibited if it occurs during employees' off-work hours and off Authority premises and the prohibited conduct is related to the employee's work with the Authority.

(3) Prior to issuing a restriction of access notice, the Authority shall make an individualized assessment as to whether the conduct listed in section (1) of this rule is a result of a disability of which the Authority has knowledge and whether the conduct is a "direct threat" to others as described in OAR 943-005-0000 through 943-005-0030. If the Authority determines the disabled individual's conduct is not a direct threat, the Authority shall explore the possibility of a reasonable accommodation to mitigate the safety risk.

(4) The prohibitions on conduct in this rule do not apply to individuals who are residents of an Authority-operated residential facility.

History

Statutory/Other Authority: ORS 413.042
Statutes/Other Implemented: ORS 413.042 & 654.010
OHA 18-2011, f. 8-30-11, cert. ef. 9-1-11
OHA 7-2011(Temp), f. & cert. ef. 7-1-11 thru 12-27-11

Or. Admin. R. 943-012-0015 Continuation of Eligible Services

(1) An individual whose access has been restricted by the Authority shall continue to be provided services for which the individual meets program eligibility requirements by an alternate and effective method of communication as determined by the Authority.

(2) Alternate methods may include telephone, electronic mail, written communication, meeting at a designated secure site, or through the individual's representative.

History

Statutory/Other Authority: ORS 413.042
Statutes/Other Implemented: ORS 413.042 & 654.010
OHA 18-2011, f. 8-30-11, cert. ef. 9-1-11
OHA 7-2011(Temp), f. & cert. ef. 7-1-11 thru 12-27-11

Or. Admin. R. 943-012-0020 Notification

(1) If the Authority determines that it is necessary to restrict access or the methods of communication because of prohibited conduct, the individual will be provided written notification, signed by the assistant director or deputy assistant director of the affected division, and sent by certified mail or other traceable means. The notice shall describe the following:

(a) Conduct giving rise to the restrictions;

(b) The specific premises or parts of premises from which the individual is excluded; or the forms of communication which are restricted;

(d) Contact information for services or appointment scheduling;

(e) The availability of the review process, including notification that individuals with disabilities are entitled to request modification;

(f) The potential criminal consequences for violating the notice of restriction of access; and

(g) The law enforcement agency being notified.

(2) The notice shall be effective upon issuance.

(3) Restrictions on access to Authority premises or methods of communication shall remain in place until the Authority determines the individual no longer poses a threat and issues an official notification of removal.

History

Statutory/Other Authority: ORS 413.042
Statutes/Other Implemented: ORS 413.042 & 654.010
OHA 18-2011, f. 8-30-11, cert. ef. 9-1-11
OHA 7-2011(Temp), f. & cert. ef. 7-1-11 thru 12-27-11

Or. Admin. R. 943-012-0025 Authority Review

(1) The Authority shall establish an internal review process to ensure that a notice of restriction of access is warranted prior to issuing a written notice of restriction of access.

(2) Following the Authority's issuance of a notice of restriction of access, the recipient of the notice may request review of the Authority's determination. The request must be submitted to the office of the Director of the Authority. The request must be in writing and submitted, by mail or personal delivery, within 15 business days of the date of issuance of the notice of restriction of access. If the request is submitted by mail, it must be postmarked within 15 business days. No particular format is required for the request for review; however, the individual should include specific grounds for requesting the review.

(3) Upon receipt of a request for review, the Director or an assistant director shall review the request and issue a written decision. The review may include an informal conference. The decision shall be issued within ten days of receipt of the request for review.

(4) The Authority’s decision is final.

(5) If the Authority’s decision rules in favor of the individual, the restricted individual's access restriction shall be immediately lifted. If the decision is unfavorable to the restricted individual, the restricted individual may seek further review after six months have lapsed since the date of issuance by following the process described in this rule.

History

Statutory/Other Authority: ORS 413.042
Statutes/Other Implemented: ORS 413.042 & 654.010
OHA 18-2011, f. 8-30-11, cert. ef. 9-1-11
OHA 7-2011(Temp), f. & cert. ef. 7-1-11 thru 12-27-11

Division 14 PRIVACY AND CONFIDENTIALITY

Or. Admin. R. 943-014-0000 Definitions

The following definitions apply to OAR 943-014-0000 to 943-014-0070:

(1) “Administrative Hearing” means an oral proceeding before an administrative law judge in a contested case hearing.

(2) “Authority” means the Oregon Health Authority.

(3) “Authority Workforce” means employees, volunteers, trainees, and other persons whose conduct, in the performance of work for the Authority, is under the direction and control of the Authority, whether or not they are paid by the Authority.

(4) “Authorization” means permission from an individual or his or her personal representative giving the Authority, and others named on the form, authorization to obtain, release or use information about the individual from third parties for specified purposes or to disclose information to a third party specified by the individual.

(5) “Business Associate” means an individual or entity performing any function or activity on behalf of the Authority involving the use or disclosure of protected health information (PHI) and is not a member of the Authority’s workforce.

(a) “Function or activity” includes but is not limited to program administration, claims processing or administration, data analysis, utilization review, quality assurance, billing, legal, actuarial, accounting, consulting, data processing, management, administrative, accreditation, financial services, and similar services for which the Authority may contract or obtain by interagency agreement, if access to PHI is involved.

(b) Business associates do not include licensees or providers unless the licensee or provider also performs some function or activity on behalf of the Authority.

(6) “Client” means an individual who requests or receives program benefits or direct services from the Authority, including but not limited to services requested in connection with the administration of the medical assistance program, and individuals who apply for or are admitted to a state hospital or who are committed to the custody of the Authority,

(7) “Client Information” means personal information relating to a client that the Authority may maintain in one or more locations and in various forms, reports, or documents, or stored or transmitted by electronic media.

(8) “Collect” or “Collection” means the assembling of personal information through interviews, forms, reports, or other information sources.

(9) “Contract” means a written agreement between the Authority and a person or entity setting forth the rights and obligations of the parties including but not limited to contracts, licenses, agreements, interagency agreements, and intergovernmental agreements.

(10) “Correctional Institution” means any penal or correctional facility, jail, reformatory, detention center, work farm, halfway house, or residential community program center operated by contract with the federal government, a state, or an Indian tribe for the confinement or rehabilitation of persons charged with or convicted of a criminal offense or other persons held in lawful custody. “Other persons held in lawful custody” include juvenile offenders, adjudicated delinquents, noncitizen detained awaiting deportation, witnesses, or others awaiting charges or trial.

(11) “Corrective Action” means an action that a business associate must take to remedy a breach or violation of the business associate’s obligations under the business associate’s contractual requirement, including but not limited to reasonable steps that must be taken to cure the breach or end the violation.

(12) “Covered Entity” means health plans, health care clearinghouses, and health care providers who transmit any health information in electronic form in connection with a transaction that is subject to federal Health Insurance Portability and Accountability Act (HIPAA) requirements, as those terms are defined and used in the HIPAA regulations, 45 CFR parts 160 and 164.

(13) “De-identified Data” means client information from which the Authority or other entity has deleted, redacted, or blocked identifiers so the remaining information cannot reasonably be used to identify an individual.

(14) “Department” means the Department of Human Services.

(15) “Disclose” means the release, transfer, relay, provision of access to, or conveying of client information to any individual or entity outside the Authority.

(16) “Health Care” means care, services, or supplies related to the health of an individual. Health care includes but is not limited to preventive, diagnostic, therapeutic, rehabilitative, maintenance, palliative care, counseling services, assessment, or procedures with respect to the physical or mental condition, or functional status of an individual, or that affects the structure or function of the body and the sale or dispensing of a drug, device, equipment, or other prescribed item.

(17) “Health Care Operations” means any activities of the Authority to the extent that the activities are related to health care, Medicaid, or any other health care related programs, services, or activities administered by the Authority and include:

(a) Conducting quality assessment and improvement activities, including income evaluation and development of clinical guidelines;

(b) Population-based activities related to improving health or reducing health care costs, protocol development, case management and care coordination, contacting health care providers and patients with information about treatment alternatives; and related functions that do not include treatment;

(c) Reviewing the competence of qualifications of health care professionals, evaluating practitioner, provider, and health plan performance; and conducting training programs in which students and trainees in areas of health care learn under supervision to practice or improve their skills, accreditation, certification, licensing, or credentialing activities;

(d) Underwriting, premium rating, and other activities relating to the creation, renewal, or replacement of a contract for Medicaid or health care related services;

(e) Conducting or arranging for medical review, legal services, and auditing functions, including fraud and abuse detection and compliance programs, and disclosure to the Medicaid Fraud Unit pursuant to 43 CFR part 455.21;

(f) Business planning and development, such as conducting cost-management and planning-related analyses related to managing and operating the Authority, including administration, development, or improvement of methods of payments or health care coverage; and

(g) Business management and general administrative activities of the Authority, including but not limited to:

(A) Management activities relating to implementation of and compliance with the requirements of HIPAA;

(B) Customer service, including providing data analysis;

(C) Resolution of internal grievances, including administrative hearings and the resolution of disputes from patients or enrollees regarding the quality of care and eligibility for services; and

(D) Creating de-identified data or a limited data set.

(18) “Health Oversight Agency” means an agency or authority of the federal government, a state, territory, political subdivision of a state or territory, Indian tribe, or a person or entity acting under a grant of authority from or by contract with the public agency, including employees or agents of the public agency or its contractors or grantees that is authorized by law to oversee the health care system or government programs in which health information is necessary to determine eligibility or compliance, or to enforce civil rights laws for which health information is relevant. When performing these functions, the Authority acts as a health oversight agency for the purposes of these rules.

(19) “HIPAA” means the Title II, Subtitle F of the Health Insurance Portability and Accountability Act of 1996, 42 USC 1320d et seq, and the federal regulations adopted to implement the Act.

(20) “Individual” means the person who is the subject of information collected, used, or disclosed by the Authority.

(21) “Individually Identifying Information” means any single item or compilation of information or data that indicates or reveals the identity of an individual, either specifically (such as the individual’s name or social security number), or from which the individual’s identity can be reasonably ascertained.

(22) “Information” means personal information relating to an individual, a participant, or an Authority client.

(23) “Inmate” means a person incarcerated in or otherwise confined in a correctional institution. An individual is no longer an inmate when released on parole, probation, supervised release, or is otherwise no longer in custody.

(24) “Institutional Review Board (IRB)” means a specially constituted review body established or designated by an entity in accordance with 45 CFR part 46 to protect the welfare of human subjects recruited to participate in biomedical or behavioral research. The IRB must be registered with the Office for Human Research Protection.

(25) “Law Enforcement Official” means an officer or employee of any agency or authority of the federal government, a state, territory, political subdivision of a state or territory, or Indian tribe who is empowered by law to:

(a) Investigate and conduct an official inquiry into a potential violation of law; or

(b) Prosecute or otherwise conduct a criminal, civil, or administrative proceeding arising from an alleged violation of law.

(26) “Licensee” means a person or entity that applies for or receives a license, certificate, registration, or similar authority from the Authority to perform or conduct a service, activity, or function.

(27) “Minimum Necessary” means the least amount of information, when using or disclosing confidential client information, that is needed to accomplish the intended purpose of the use, disclosure, or request.

(28) “Participant” means individual’s participating in Authority population-based services, programs, and activities that serve the general population, but who do not receive program benefits or direct services received by a client. Examples of participants include but are not limited to an individual whose birth certificate is recorded with Department of Vital Statistics, the subjects of public health studies, immunization or cancer registries, newborn screening, and other public health services, and individuals who contact Authority hotlines or the ombudsman for general public information services.

(29) “Payment” means any activities undertaken by the Authority related to a client to whom health care is provided in order to:

(a) Obtain premiums or to determine or fulfill its responsibility for coverage and provision of benefits under the Medicaid program or other publicly funded health care services; and

(b) Obtain or provide reimbursement for the provision of health care.

(30) Payment activities mean:

(a) Determinations of eligibility or coverage, including coordination of benefits or the determination of cost sharing amounts, and adjudication of health benefit or health care claims;

(b) Risk adjusting amounts due which are based on enrollee health status and demographic characteristics;

(c) Billing, claims management, collection activities, obtaining payment under a contract for reinsurance, and related health care data processing;

(d) Review of health care services with respect to medical necessity, coverage under a health plan, appropriateness of care, or justification of charges;

(e) Utilization review activities, including pre-certification and pre-authorization of services, concurrent and retrospective review of services; and

(f) Disclosure to consumer reporting agencies relating to collection of premiums or reimbursement including name and address, date of birth, payment history, account number, and name and address of the health care provider or health plan.

(31) “Personal Representative” means a person who has authority to act on behalf of an individual in making decisions related to health care.

(32) “Protected Health Information (PHI)” means any individually identifiable health information, whether oral or recorded in any form or medium, that is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse and relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual. Any data transmitted or maintained in any other form or medium by covered entities, including paper records, fax documents, all oral communications, or any other form, such as screen prints of eligibility information, printed e-mails containing identified individual’s health information, claim or billing information, or hard copy birth or death certificates. PHI does not include school records that are subject to the Family Educational Rights and Privacy Act and employment records held in the Authority’s role as an employer.

(33) “Protected Information” means any participant or client information that the Authority may have in its records or files that must be safeguarded pursuant to Authority policy. This includes but is not limited to individually identifying information.

(34) “Provider” means a person or entity that may seek reimbursement from the Authority as a provider of services to Authority clients pursuant to a contract. For purposes of these rules, reimbursement may be requested on the basis of claims or encounters or other means of requesting payment.

(35) “Psychotherapy Notes” mean notes recorded in any medium by a health care provider who is a mental health professional documenting or analyzing the contents of conversations during a private counseling session, or group, joint, or family counseling session, when the notes are separated from the rest of the individual’s record. Psychotherapy notes do not include medication prescription and monitoring, counseling session start and stop times, the modalities and frequencies of treatment furnished, results of clinical tests, and any summary of diagnosis, functional status, treatment plan, symptoms, prognosis, or progress to date.

(36) “Public Health Agency” means a public agency, including the Authority, or a person or entity acting under a grant of authority from or by contract with the Authority or public agency that performs or conducts one or more of the following essential functions that characterize public health programs, services, or activities:

(a) Monitor health status to identify community health problems;

(b) Diagnose and investigate health problems and health hazards in the community;

(A) Inform, educate, and empower people about health issues;

(B) Mobilize community partnerships to identify and solve health problems;

(D) Enforce laws and regulations that protect health and ensure safety;

(E) Direct individuals to needed personal health services and assure the provision of health care when otherwise unavailable;

(F) Ensure a competent public health and personal health care workforce;

(G) Evaluate the effectiveness, accessibility, and quality of personal and population-based health services; and

(H) Perform research for new insights and innovative solutions to health problems.

(37) “Public Health Authority” means an agency or authority of the federal government, a state, territory, political subdivision of a state or territory, Indian tribe, or a person or entity acting under a grant of authority from or by contract with the public agency, including the employees or agents of the public agency, or its contractors or persons or entities to whom it has granted authority, that is responsible for public health matters as part of its official mandate. When performing functions as a public health agency, the Authority acts as a public health authority for purposes of these rules.

(38) “Re-disclosure” means the disclosure of information to a person, an Authority program, an Authority subcontracted entity, or other entity or person other than what was originally authorized.

(39) “Research” means systematic investigation, including research development, testing, and evaluation, designed to develop or contribute to generalized knowledge.

(40) “Required by Law” means a duty or responsibility that federal or state law specifies that a person or entity must perform or exercise. Required by law includes but is not limited to court orders and court-ordered warrants; subpoenas or summons issued by a court, grand jury, a governmental or tribal inspector general, or an administrative body authorized to require the production of information; a civil or an authorized investigative demand; Medicare conditions of participation with respect to health care providers participating in the program; and statutes or rules that require the production of information, including statutes or rules that require such information if payment is sought under a government program providing public benefits.

(41) “Treatment” means the provision, coordination, or management of heath care and related services by one or more health care providers, including the coordination or management of health care by a health care provider with a third party, consultation between health care providers relating to a patient, or the referral of a patient for health care from one health care provider to another.

(42) “Use” means the sharing of individual information within an Authority program or the sharing of individual information between program staff and administrative staff that support or oversee the program.

History

Statutory/Other Authority: ORS 413.042
Statutes/Other Implemented: ORS 179.505, 192.518 – 192.529, 411.010, 413.032 & 414.065
OHA 1-2022, minor correction filed 04/25/2022, effective 04/25/2022
OHA 22-2011, f. & cert. ef. 9-2-11
OHA 8-2011(Temp), f. & cert. ef. 7-1-11 thru 12-27-11

Or. Admin. R. 943-014-0010 Purpose

(1) The purpose of these rules (OAR 943-014-000 to 943-014-0070) is to govern the collection, use, and disclosure of protected information by the Authority about individuals and to explain the rights and specific actions that individuals may take or request to be taken regarding the uses and disclosures of their protected information. These rules also set forth the Authority’s requirements governing the use and disclosure of PHI for purposes of HIPAA, 42 USC 1320-d through 1320d-8, Pub L 104-191, sec. 262 and 264, and the implementing HIPAA privacy rules, 45 CFR parts 160 and 164, applicable to the Authority’s health care components.

(2) Except as provided in section (1) of this rule, state and federal statutes, rules, and policies that govern the administration of Authority programs, services, and activities continue to govern the use and disclosure of protected information in those Authority programs, services, and activities.

(3) In the event that it is not possible to comply with the requirements of both sections (1) and (2) of this rule, the Authority shall act in accordance with whichever federal or state law imposes a stricter requirement regarding the privacy or safeguarding of information and which provides the greater protection or access to the individual who is the subject of the information, unless one of the following applies:

(a) Public health. Nothing in these rules shall be construed to invalidate or limit the authority, power, or procedures established under any law providing for the reporting of disease or injury, birth, or death; public health surveillance; or public health investigation or intervention.

(b) Child abuse. Nothing in these rules shall be construed to invalidate or limit the authority, power, or procedures established under any law providing for the reporting of child abuse.

(c) State regulatory reporting. Nothing in these rules shall be construed to limit the ability of the State of Oregon or the Authority to require a health plan to report, or to provide access to information for management audits, financial audits, program monitoring, facility licensure or certification, or individual licensure or certification.

(4) The Authority may collect, maintain, use, transmit, share, and disclose information about any individual to the extent authorized by law to administer Authority programs, services, and activities.

(5) The Authority may use and disclose information about licensees or providers consistent with federal and state laws and regulations. Information regarding the qualifications of licensees and providers are public records.

(a) When the Authority obtains information about individuals that relates to determining payment responsibility when a provider submits a request for payment to the Authority, the Authority shall safeguard the information consistent with federal and state laws and regulations and Authority policies.

(b) The Authority may review the performance of licensees and providers in the conduct of its health oversight activities and shall safeguard information obtained about individuals obtained during those activities in accordance with federal and state laws and regulations and Authority policies.

History

Statutory/Other Authority: ORS 413.042
Statutes/Other Implemented: ORS 179.505, 192.518 – 192.529, 411.010, 413.032 & 414.065
OHA 22-2011, f. & cert. ef. 9-2-11
OHA 8-2011(Temp), f. & cert. ef. 7-1-11 thru 12-27-11

Or. Admin. R. 943-014-0015 Covered Entity Status for Purposes of the HIPAA Privacy Rules

(1) These rules address information that, among other things, may be Protected Health Information that is protected by the HIPAA Privacy Rules. For purposes of HIPAA Privacy Rules, the Authority is a hybrid entity because the Authority performs functions that are covered by HIPAA (“health care components”) and functions that are not covered by HIPAA. The Authority’s health care components consist of the functions that are included in the definition of a covered entity, as follows:

(a) The Authority in its capacity as the state Medicaid agency for the administration of the Medicaid program under Title XIX of the Social Security Act and the Children’s Health Insurance Program under Title XXI of the Act and the medical assistance program as described in ORS chapter 414.

(b) The Health Care for All Oregon Children program;

(d) Any medical assistance or premium assistance programs reimbursed with Medicaid or the Children’s Health Insurance Program funds operated by the Authority;

(e) The Oregon State Hospital and Blue Mountain Recovery Center;

(f) The high risk pools administered by the Oregon Medical Insurance Pool Board and the Office of Private Health Partnerships;

(g) The Breast and Cervical Cancer Program and the Wise Woman Program;

(h) The Public Health Laboratory;

(i) The Medicaid Management Information system and information technology systems associated with the administration and management of the health care components listed above; and

(j) The ombudsman and other administrative and health care operations functions associated with the administration and management of the health care components listed above.

(2) The Authority administers many aspects of the medical assistance program with the assistance of the Department, including but not limited to eligibility determinations for the medical assistance program and supervising the long-term and community-based services for seniors and people with disabilities. The Department also provides certain health care operations services for the Authority. In doing so, the Department is a business associate of the Authority. As a business associate of the Authority, the Department is authorized to use and disclose protected health information to perform or assist the Authority in the performance of its covered functions.

(3) When these rules of the Authority apply to PHI that is subject to the HIPAA Privacy and Security rules, a reference to the Authority may also include the actions of the Department acting as the Authority’s business associate.

History

Statutory/Other Authority: ORS 413.042
Statutes/Other Implemented: ORS 179.505, 192.518 – 192.529, 411.010, 413.032 & 414.065
OHA 22-2011, f. & cert. ef. 9-2-11
OHA 8-2011(Temp), f. & cert. ef. 7-1-11 thru 12-27-11

Or. Admin. R. 943-014-0020 Uses and Disclosures of Client or Participant Protected Information

(1) Uses and disclosures with individual authorization. The Authority must obtain a completed and signed authorization for release of information from the individual, or the individual’s personal representative, before obtaining or using protected information about an individual from a third party or disclosing protected information about the individual to a third party.

(a) Uses and disclosures must be consistent with what the individual has approved on the signed authorization form approved by the Authority.

(b) An individual may revoke an authorization at any time. The revocation must be in writing and signed by the individual, except that substance abuse treatment patients may orally revoke an authorization to disclose information obtained from substance abuse treatment programs. No revocation shall apply to information already released while the authorization was valid and in effect.

(2) Uses and disclosures without authorization. The Authority may use and disclose information without written authorization in the following circumstances:

(a) The Authority may disclose information to individuals who have requested disclosure to themselves of their information, if the individual has the right to access the information under OAR 943-014-0030(6).

(b) If the law requires or permits the disclosure, and the use and disclosure complies with, and is limited to, the relevant requirements of the relevant law.

(A) Activities involving the current treatment of an individual, for the Authority or health care provider;

(B) Payment activities, for the Authority, covered entity, or health care provider;

(D) Substance abuse treatment information, if the recipient has a Qualified Service Organization Agreement with the Authority.

(d) Psychotherapy notes. The Authority may only use and disclose psychotherapy notes in the following circumstances:

(A) In the Authority’s supervised counseling training programs;

(B) In connection with oversight of the originator of the psychotherapy notes; or

(e) Public health activities.

(A) The Authority may disclose an individual’s protected information to appropriate entities or persons for governmental public health activities and for other purposes including but not limited to:

(i) A governmental public health authority that is authorized by law to collect or receive protected information for the purpose of preventing or controlling disease, injury, or disability. This includes but is not limited to reporting disease, injury, and vital events such as birth or death; and the conducting of public health surveillance, investigations, and interventions;

(ii) An official of a foreign government agency that is acting in collaboration with a governmental public health authority;

(iii) A governmental public health authority, or other government authority that is authorized by law to receive reports of child abuse or neglect;

(iv) A person subject to the jurisdiction of the federal Food and Drug Administration (FDA), regarding an FDA-regulated product or activity for which that person is responsible for activities related to the quality, safety, or effectiveness of an FDA-regulated product or activity; or

(v) A person who may have been exposed to a communicable disease, or may be at risk of contracting or spreading a disease or condition, if the Authority or other public health authority is authorized to notify the person as necessary in conducting a public health intervention or investigation.

(B) Where state or federal law prohibits or restricts use and disclosure of information obtained or maintained for public health purposes, the Authority shall deny the use and disclosure.

(f) Child abuse reporting and investigation. If the Authority has reasonable cause to believe that a child is a victim of abuse or neglect, the Authority may disclose protected information to appropriate governmental authorities authorized by law to receive reports of child abuse or neglect.

(g) Adult abuse reporting and investigation. If the Authority has reasonable cause to believe that a vulnerable adult is a victim of abuse or neglect, the Authority may disclose information, as required by law, to a government authority or regulatory agency authorized by law to receive reports of abuse or neglect including but not limited to a social service or protective services agency authorized by law to receive such reports. Vulnerable adults are adults age 65 or older and persons with disabilities.

(h) Health oversight activities. The Authority may disclose information without authorization for health oversight activities, including audits; civil, criminal, or administrative investigations, prosecutions, licensing or disciplinary actions; Medicaid fraud; or other necessary oversight activities.

(i) Administrative and court hearings, grievances, investigations, and appeals.

(A) The Authority may use or disclose information for an investigation, administrative or court hearing, grievance, or appeal about an individual’s eligibility or right to receive Authority benefits or services.

(B) If the Authority has obtained information in performing its duties as a health oversight agency, public health authority, or public benefit program, the Authority may use or disclose that information in an administrative or court hearing consistent with the other privacy requirements applicable to that program, service, or activity.

(j) Court orders. The Authority may disclose information for judicial or administrative proceedings in response to a court order, subpoena, discovery request, or other legal process. If a court orders the Authority to conduct a mental examination pursuant to ORS 161.315, 161.365, 161.370, or orders the Authority to provide any other report or evaluation to the court, the examination, report, or evaluation shall be deemed to be required by law for purposes of HIPAA.

(k) Law enforcement purposes. For limited law enforcement purposes, the Authority may report certain injuries or wounds; provide information to identify or locate a suspect, victim, or witness; alert law enforcement of a death as a result of criminal conduct; and provide information which constitutes evidence of criminal conduct on Authority premises.

(A) The Authority may provide client information to a law enforcement officer in any of the following situations:

(i) The law enforcement officer is involved in carrying out any investigation, criminal, or civil proceedings connected with administering the program from which the information is sought;

(ii) An Authority employee may disclose information from personal knowledge that does not come from the client’s interaction with the Authority;

(iii) The disclosure is authorized by statute or administrative rule;

(iv) The information informs law enforcement of a death as a result of criminal conduct;

(v) The information constitutes evidence of criminal conduct on Authority premises; or

(vi) The disclosure is necessary to protect the client or others, and the client poses a threat to his or her safety or to the safety of others.

(B) Except as provided in section (2)(k)(C) of this rule, the Authority may give a client’s current address, Social Security number, and photo to a law enforcement officer if the law enforcement officer makes the request in the course of official duty, supplies the client’s name, and states that the client:

(i) Is a fugitive felon or is violating parole, probation, or post-prison supervision;

(ii) For all public assistance programs, has information that is necessary for the officer to conduct official duties, and the location or apprehension of the client is within the officer’s official duties; or

(C) If domestic violence has been identified in the household, the Authority may not release information about a victim of domestic violence unless a member of the household is either wanted as a fugitive felon or is violating parole, probation, or post-prison supervision.

(D) For purposes of this subsection, a fugitive felon is a person fleeing to avoid prosecution or custody for a crime, or an attempt to commit a crime, that would be classified as a felony.

(E) For purposes of this section, a law enforcement officer is an employee of the Oregon State Police, a county sheriff’s department, or a municipal police department, whose official duties include arrest authority.

(l) Use and disclosure of information about deceased individuals.

(A) The Authority may disclose individual information to a coroner or medical examiner for the purpose of identifying a deceased individual, determining cause of death, or other duties authorized by law.

(B) The Authority may disclose individual information to funeral directors as needed to carry out their duties regarding the decedent. The Authority may also disclose individual information prior to, and in anticipation of, the death.

(m) Organ or tissue donation. The Authority may disclose individual information to organ procurement organizations or other entities engaged in procuring, banking, or transplanting cadaver organs, eyes, or tissue for the purpose of facilitating transplantation.

(n) Research. The Authority may disclose individual information without authorization for research purposes, as specified in OAR 943-014-0060.

(o) Threat to health or safety. To avert a serious threat to health or safety the Authority may disclose individual information if:

(A) The Authority believes in good faith that the information is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public; and

(B) The report is to a person or persons reasonably able to prevent or lessen the threat, including the target of the threat.

(p) National security and intelligence. The Authority may disclose information to authorized federal officials for lawful intelligence, counterintelligence, and other national security activities.

(q) Correctional institutions and law enforcement custody situations. The Authority may disclose information to a correctional institution or a law enforcement official having lawful custody of an inmate or other person, for the limited purpose of providing health care or ensuring the health or safety of the person or other inmates.

(r) Emergency treatment. In case of an emergency, the Authority may disclose individual information to the extent needed to provide emergency treatment.

(s) Government entities providing public benefits. The Authority may disclose eligibility and other information to governmental entities administering a government program providing public benefits.

(3) Authorization not required if opportunity to object given. The Authority may use and disclose an individual’s information without authorization if the Authority informs the individual in advance and gives the individual an opportunity to either agree or refuse or restrict the use and disclosure.

(a) These disclosures are limited to disclosure of information to a family member, other relative, close personal friend of the individual, or any other person named by the individual, subject to the following limitations:

(A) The Authority may disclose only the protected information that directly relates to the person’s involvement with the individual’s care or payment for care.

(B) The Authority may use and disclose protected information for notifying, identifying, or locating a family member, personal representative, or other person responsible for care of the individual, regarding the individual’s location, general condition, or death. For individuals who had resided at one time at the state training center, OAR 411-320-0090(6) addresses family reconnection.

(C) If the individual is present for, or available prior to, a use and disclosure, the Authority may disclose the protected information if the Authority:

(i) Obtains the individual’s agreement;

(ii) Provides the individual an opportunity to object to the disclosure, and the individual does not object; or

(iii) Reasonably infers from the circumstances that the individual does not object to the disclosure.

(D) If the individual is not present, or the opportunity to object to the use and disclosure cannot practicably be provided due to the individual’s incapacity or an emergency situation, the Authority may disclose the information if, using professional judgment, the Authority determines that the use and disclosure is in the individual’s best interests.

(b) Exception. For individuals referred to or receiving substance abuse treatment, mental health, or vocational rehabilitation services, the Authority shall not use or disclose information without written authorization, unless disclosure is otherwise permitted under 42 CFR part 2, 34 CFR 361.38, or ORS 179.505.

(c) Personal representative. The Authority must treat a personal representative as the individual for purposes of these rules, except that:

(A) A personal representative must be authorized under state law to act on behalf of the individual with respect to use and disclosure of information. The Authority may require a personal representative to provide a copy of the documentation authorizing the person to act on behalf of the individual.

(B) The Authority may elect not to treat a person as a personal representative of an individual if:

(i) The Authority has a reasonable belief that the individual has been or may be subjected to domestic violence, abuse, or neglect by the person;

(ii) The Authority, in the exercise of professional judgment, decides that it is not in the best interest of the individual to treat the person as the individual’s personal representative.

(4) Redisclosure. The Authority must inform the individual that information held by the Authority and authorized by the individual for disclosure may be subject to redisclosure and no longer protected by these rules.

(5) Specific written authorization. If the use or disclosure of information requires an authorization, the authorization must specify that the Authority may use or disclose vocational rehabilitation records, alcohol and drug records, HIV/AIDS records, genetics information, and mental health or developmental disability records held by publicly funded providers.

(a) Pursuant to federal regulations at 42 CFR part 2 and 34 CFR 361.38, the Authority may not make further disclosure of vocational rehabilitation and alcohol and drug rehabilitation information without the specific written authorization of the individual to whom it pertains.

(b) Pursuant to ORS 433.045 and OAR 333-012-0270, the Authority may not make further disclosure of individual information pertaining to HIV/AIDS.

(6) Verification of person or entity requesting information. The Authority may not disclose information about an individual without first verifying the identity of the person or entity requesting the information, unless the Authority workforce member fulfilling the request already knows the person or has already verified identity.

(7) Whistleblowers. The Authority may disclose an individual’s protected health information under the HIPAA privacy rules under the following circumstances:

(a) The Authority workforce member or business associate believes in good faith that the Authority has engaged in conduct that is unlawful or that otherwise violates professional standards or Authority policy, or that the care, services, or conditions provided by the Authority could endanger Authority staff, individuals in Authority care, or the public; and

(b) The disclosure is to a government oversight agency or public health authority, or an attorney of an Authority workforce member or business associate retained for the purpose of determining the legal options of the workforce member or business associate with regard to the conduct alleged under section (7)(a) above; and

(c) Nothing in this rule is intended to interfere with ORS 659A.200 to 659A.224 describing the circumstances applicable to disclosures by Authority workforce or business associates.

History

Statutory/Other Authority: ORS 413.042
Statutes/Other Implemented: ORS 179.505, 192.518 – 192.529, 411.010, 413.032 & 414.065
OHA 22-2011, f. & cert. ef. 9-2-11
OHA 8-2011(Temp), f. & cert. ef. 7-1-11 thru 12-27-11

Or. Admin. R. 943-014-0030 Client Privacy Rights

(1) Rights of clients to access their information. Clients may access, inspect, and obtain a copy of information on their own cases in Authority files or records, consistent with federal and state law.

(a) A client may request access by completing the Access to Records Request form, or by providing sufficient information to accomplish this request.

(b) Clients may request access to their own information that is kept by the Authority by using a personal identifier such as the client’s name or Authority case number.

(c) If the Authority maintains information in a record that includes information about other people, the client may see information only about himself or herself.

(d) If a person identified in the file is a minor child of the client, and the client is authorized under Oregon law to have access to the minor’s information or to act on behalf of the minor for making decisions about the minor’s care, the client may obtain information about the minor.

(e) If the requestor of information is recognized under Oregon law as a the client’s guardian or custodian and is authorized under Oregon law to have access to the client’s information or to act on behalf of the client for making decisions about the client’s services or care, the Authority shall release information to the requestor.

(f) For individuals with disabilities or mental illnesses, the named system in ORS 192.517, to protect and advocate the rights of individuals with developmental disabilities under Part C of the Developmental Disabilities Assistance and Bill of Rights Act (42 U.S.C. 6041 et seq.) and the rights of individuals with mental illness under the Protection and Advocacy for Individuals with Mental Illness Act (42 U.S.C. 10801 et seq.), shall have access to all records defined in ORS 192.515.

(g) The Authority may deny a client’s access to their own PHI if federal law prohibits the disclosure. Clients may access, inspect, and obtain a copy of health information on their own case in Authority files or records except for the following:

(A) Psychotherapy notes;

(B) Information compiled in reasonable anticipation of, or for use in civil, criminal, or administrative proceedings;

(C) Information that is subject to the federal Clinical Labs Improvement Amendments of 1988, or exempt pursuant to 42 CFR 493.3(a)(2);

(D) Information that the Authority believes, in good faith, can cause harm to the client, participant, or to any other person; and

(E) Documents protected by attorney work-product privilege.

(h) The Authority may deny a client access to information that was obtained under a promise of confidentiality from a person other than a health care provider to the extent that access would reveal the source of the information.

(i) The Authority may deny a client access to information, if the Authority gives the client a right to have the denial reviewed when:

(A) A licensed health care professional (for health information) or other designated staff (for other information) has determined, in the exercise of professional judgment, that the information requested may endanger the life or physical safety of the client or another person;

(B) The information makes reference to another person, and a licensed health care professional (for health information) or other designated staff (for other information) has determined, in the exercise of professional judgment, that the information requested may cause substantial harm to the client or to another person; or

(C) The request for access is made by the client’s personal representative, and a licensed health care professional (for health information) or other designated staff (for other information) has determined, in the exercise of professional judgment, that allowing the personal representative access to the information may cause substantial harm to the client or to another person.

(j) If the Authority denies access under section (1)(i) of this rule, the client may have the decision reviewed by a licensed health care professional (for health information) or other designated staff (for other information) not directly involved in making the original denial decision.

(A) The Authority must promptly refer a client’s request for review to the designated reviewer.

(B) The reviewer must determine, within the 30 or 60-day time limits stated in section (1)(k)(A) and (B) of this rule, whether to approve or deny the client’s request for access.

(i) Promptly notify the client in writing of the reviewer’s determination; and

(ii) If approved, take action to carry out the reviewer’s determination.

(k) The Authority must act on a client’s request for access no later than 30 days after receiving the request, except as provided in this section and in the case of written accounts under ORS 179.505, which must be disclosed within five days.

(A) In cases where the information is not maintained or accessible to the Authority on-site, and does not fall under ORS 179.505, the Authority must act on the client’s request no later than 60 days after receiving the request.

(B) If the Authority is unable to act within the 30 or 60-day limits, the Authority may extend this time period a maximum of 30 additional days, subject to the following:

(i) The Authority must notify the client in writing of the reasons for the delay and the date by which the Authority shall act on the request.

(ii) The Authority shall use only one 30-day extension.

(l) If the Authority grants the client’s request, in whole or in part, the Authority must inform the client of the access decision and provide the requested access.

(A) If the Authority maintains the same information in more than one format or at more than one location, the Authority may provide the requested information once.

(B) The Authority must provide the requested information in a form or format requested by the client, if readily producible in that form or format. If not readily producible, the Authority shall provide the information in a readable hard-copy format or other format as agreed to by the Authority and the client.

(C) The Authority may provide the client with a summary of the requested information, in lieu of providing access, or may provide an explanation of the information if access has been provided, if:

(i) The client agrees in advance; and

(ii) The client agrees in advance to pay any fees the Authority may impose, under section (1)(L)(E) of this rule.

(D) The Authority shall arrange with the client for providing the requested access in a time, place, and manner convenient for the client and the Authority.

(E) If a client, or legal guardian or custodian, requests a copy, written summary, or explanation of the requested information, the Authority may impose a reasonable cost-based fee, limited to the following:

(i) Copying the requested information, including the costs of supplies and the labor of copying;

(ii) Postage; and

(iii) Staff time for preparing an explanation or summary of the requested information.

(m) If the Authority denies access, in whole or in part, to the requested information, the Authority must:

(A) Give the client access to any other requested client information, after excluding the information to which access is denied; and

(B) Provide the client with a timely written denial. The denial must:

(i) Be provided within the time limits specified in section (1)(k)(A) and (B) of this rule;

(ii) State the basis of the denial in plain language;

(iii) If the Authority denies access under section (1)(i) of this rule, explain the client’s review rights as specified in section (1)(j) of this rule, including an explanation of how the client may exercise these rights; and

(iv) Provide a description of how the client may file a complaint with the Authority, and if the information is PHI, with the United States Department of Health and Human Services (DHHS), Office for Civil Rights, pursuant to section (7) of this rule.

(n) If the Authority does not maintain the requested information, in whole or in part, and knows where the information is maintained (such as by a medical provider, insurer, other public agency, private business, or other non-Authority entity), the Authority must inform the client where to direct the request for access.

(2) Authority Notice of Privacy Practices. The Authority shall send clients notice about the Authority’s privacy practices as follows:

(a) The Authority shall make available to each client a notice of Authority privacy practices that describes the duty of the Authority to maintain the privacy of PHI and include a description that clearly informs the client of the types of uses and disclosures the Authority is permitted or required to make;

(b) The Authority shall provide all clients in direct care settings a notice of Authority privacy practices and shall request the client’s signature on an acknowledgement of receipt form;

(c) If the Authority revises its privacy practices, the Authority shall make the revised notice available to all clients;

(d) The Authority shall post a copy of the Authority’s Notice of Privacy Practices for public viewing at each Authority worksite and on the Authority website; and

(e) The Authority shall give a paper copy of the Authority’s Notice of Privacy Practices to any individual upon request.

(3) Right to request restrictions on uses or disclosures. Clients may request restrictions on the use or disclosure of their information.

(a) The Authority may deny the client’s request or limit its agreement to a request.

(A) The Authority may not agree to restrict uses or disclosures of information if the restriction would adversely affect the quality of the client’s care or services.

(B) The Authority may not agree to restrict uses or disclosures of information that would limit or prevent the Authority from making or obtaining payment for services.

(b) The Authority may not deny a client’s request to restrict the sharing of records of alcohol and drug treatment or records relating to vocational rehabilitation services with another Authority program.

(c) The Authority shall document the client’s request, and the reasons for granting or denying the request, in the client’s Authority case file.

(d) If the client needs emergency treatment and the restricted protected information is needed to provide the treatment, the Authority may use or disclose the restricted protected information to a provider, for the limited purpose of providing treatment. However, once the emergency situation subsides the Authority shall ask the provider not to redisclose the information.

(e) The Authority may terminate its agreement to a restriction if:

(A) The client agrees to or requests the termination in writing;

(B) The client orally requests or agrees to the termination, and the Authority documents the oral request or agreement in the client’s Authority case file; or

(C) With or without the client’s agreement, the Authority informs the client that the Authority is terminating its agreement to the restriction. Information created or received while the restriction was in place shall remain subject to the restriction.

(4) Rights of clients to request to receive information from the Authority by alternative means or at alternative locations. The Authority must accommodate reasonable requests by clients to receive communications from the Authority by alternative means, such as by mail, e-mail, fax, or telephone, and at an alternative location.

(a) The client must specify the preferred alternative means or location.

(b) The client may submit the request for alternative means or locations either orally or in writing.

(A) If the client makes a request in-person, the Authority shall document the request and ask for the client’s signature.

(B) If the client makes a request by telephone or electronically, the Authority shall document the request and verify the identity of the client.

(A) The client agrees to or requests termination of the alternative location or method of communication in writing or orally. The Authority shall document the oral agreement or request in the client’s Authority case file; or

(B) The Authority informs the client that the Authority is terminating its agreement to the alternative location or method of communication because the alternative location or method of communication is not effective. The Authority may terminate its agreement to communicate at the alternative location or by the alternate method if:

(i) The Authority is unable to contact the client at the location or by the method requested; or

(ii) The client fails to respond to payment requests, if applicable.

(5) Right of clients to request amendment of their information. Clients may request that the Authority amend information about themselves in Authority files.

(a) For all amendment requests, the Authority shall have the client complete the approved Authority form.

(b) The Authority may deny the request or limit its agreement to amend.

(c) The Authority must act on the client’s request no later than 60 days after receiving the request. If the Authority is unable to act within 60 days, the Authority may extend this time limit by a maximum of 30 additional days, subject to the following:

(A) The Authority must notify the client in writing, within 60 days of receiving the request, of the reasons for the delay and the date by which the Authority shall act on the request; and

(B) The Authority shall use only one 30-day extension.

(d) The program’s medical director, a licensed health care professional designated by the program administrator, or an Authority staff person involved in the client’s case must review the request and any related documentation prior to making a decision to amend a health or medical record.

(e) A staff person designated by the Authority shall review the request and any related documentation prior to making a decision to amend any information that is not a health or medical record.

(f) If the Authority grants the request, in whole or in part, the Authority shall:

(A) Make the appropriate amendment to the information or records, and document the amendment in the client’s Authority file or record;

(B) Provide notice to the client that the amendment has been granted, pursuant to the time limits under section (5)(c) of this rule;

(C) Obtain the client’s agreement to notify other relevant persons or entities with whom the Authority has shared or needs to share the amended information; and

(D) Inform and provide the amendment within a reasonable time to:

(i) Persons named by the client who have received the information and who need the amendment; and

(ii) Persons, including business associates of the Authority, that the Authority knows have the information that is the subject of the amendment and who may have relied, or could foreseeably rely, on the information to the client’s detriment.

(g) The Authority may deny the client’s request for amendment if:

(A) The Authority finds the information to be accurate and complete;

(B) The information was not created by the Authority;

(D) The information would not be available for inspection or access by the client, pursuant to section (1)(g) and (h) of this rule.

(h) If the Authority denies the amendment request, in whole or in part, the Authority must provide the client with a written denial. The denial must:

(A) Be sent within the time limits specified in section (5)(c) of this rule;

(B) State the basis for the denial, in plain language; and

(C) Explain the client’s right to submit a written statement disagreeing with the denial and how to file the statement. If the client files a statement:

(i) The Authority shall enter the written statement into the client’s Authority case file;

(ii) The Authority may also enter an Authority written rebuttal of the client’s written statement into the client’s Authority case file. The Authority shall send a copy of any written rebuttal to the client;

(iii) The Authority shall include a copy of the statement and any Authority written rebuttal with any future disclosures of the relevant information;

(iv) If a client does not submit a written statement of disagreement, the client may ask that if the Authority makes any further disclosures of the relevant information that the Authority shall also include a copy of the client’s original request for amendment and a copy of the Authority written denial; and

(v) The Authority shall provide information on how the client may file a complaint with the Authority and, if the information is PHI, with DHHS, Office for Civil Rights.

(6) Rights of clients to request an accounting of disclosures of PHI. Clients may receive an accounting of disclosures of PHI that the Authority has made for any period of time, not to exceed six years, preceding the request date for the accounting.

(a) For all requests for an accounting of disclosures, the client may complete the authorized Authority form “Request for Accounting of Disclosures of Health Records”, or provide sufficient information to accomplish this request.

(b) The right to an accounting of disclosures does not apply when the request is:

(A) Authorized by the client;

(B) Made prior to April 14, 2003;

(C) Made to carry out treatment, payment, or health care operations, unless these disclosures are made from an electronic health record;

(D) Made to the client;

(E) Made to persons involved in the client’s care;

(F) Made as part of a limited data set in accordance with OAR 943-014-0070;

(G) Made for national security or intelligence purposes; or

(H) Made to correctional institutions or law enforcement officials having lawful custody of an inmate.

(A) The date of the disclosure;

(B) The name and address, if known, of the person or entit, who received the disclosed information;

(D) A brief statement of the purpose of the disclosure that reasonably informs the client of the basis for the disclosure, or, in lieu of a statement, a copy of the client’s written request for a disclosure, if any.

(d) If, during the time period covered by the accounting, the Authority has made multiple disclosures to the same person or entity for the same purpose, the Authority may provide the required information for only the first disclosure. The Authority need not list the same identical information for each subsequent disclosure to the same person or entity if the Authority adds the following information:

(A) The frequency or number of disclosures made to the same person or entity; and

(B) The date of the most recent disclosure during the time period for which the accounting is requested.

(e) The Authority must act on the client’s request for an accounting no later than 60 days after receiving the request. If the Authority is unable to act within 60 days, the Authority may extend this time limit by a maximum of 30 additional days, subject to the following:

(A) The Authority must notify the client in writing, within 60 days of receiving the request, of the reasons for the delay and the date by which the Authority shall act on the request; and

(B) The Authority shall use only one 30-day extension.

(f) The Authority shall provide the first requested accounting in any 12-month period without charge. The Authority may charge the client a reasonable cost-based fee for each additional accounting requested by the client within the 12-month period following the first request, if the Authority:

(A) Informs the client of the fee before proceeding with any additional request; and

(B) Allows the client an opportunity to withdraw or modify the request in order to avoid or reduce the fee.

(g) The Authority shall document the information required to be included in an accounting of disclosures, as specified in section (6)(c) of this rule, and retain a copy of the written accounting provided to the client.

(h) The Authority shall temporarily suspend a client’s right to receive an accounting of disclosures that the Authority has made to a health oversight agency or to a law enforcement official, for a length of time specified by the agency or official, if the agency or official provides a written or oral statement to the Authority that the accounting would be reasonably likely to impede their activities. If the agency or official makes an oral request, the Authority shall:

(A) Document the oral request, including the identity of the agency or official making the request.

(B) Temporarily suspend the client’s request to an accounting of disclosures; and

(C) Limit the temporary suspension to no longer than 30 days from the date of the oral request, unless the agency or official submits a written request specifying a longer time period.

(7) Filing a complaint. Clients may file a complaint with the Authority or, if the information is PHI, with DHHS, Office for Civil Rights.

(a) Upon request, the Authority shall give clients the name and address of the specific person or office of where to submit complaints to DHHS.

(b) The Authority may not intimidate, threaten, coerce, discriminate against, or take any other form of retaliatory action against any individual filing a complaint or inquiring about how to file a complaint.

(c) The Authority may not require clients to waive their rights to file a complaint as a condition of providing treatment, payment, enrollment in a health plan, or eligibility for benefits.

(d) The Authority shall designate staff to review and determine action on complaints filed with the Authority.

(e) The Authority shall document, in the client’s Authority case file all complaints, the findings from reviewing each complaint, and the Authority’s actions resulting from the complaint. For each complaint the documentation shall include a description of corrective action that the Authority has taken, if any are necessary, or why corrective action is not needed.

History

Statutory/Other Authority: ORS 413.042
Statutes/Other Implemented: ORS 179.505, 192.518 – 192.529, 411.010, 413.032 & 414.065
OHA 22-2011, f. & cert. ef. 9-2-11
OHA 8-2011(Temp), f. & cert. ef. 7-1-11 thru 12-27-11

Or. Admin. R. 943-014-0040 Minimum Necessary Standards

(1) The Authority shall limit the use and disclosure of protected information to that which is reasonably necessary to accomplish the intended purpose of the use or disclosure which is referred to in these rules as the minimum necessary standard.

(2) This minimum necessary standard is not intended to impede the essential Authority activities of treatment, payment, health care operations, or service delivery.

(3) The minimum necessary standard applies:

(a) When using protected information within the Authority;

(b) When disclosing protected information to a third party in response to a request; or

(4) The minimum necessary standard does not apply to:

(a) Disclosures to or requests by a health care provider for treatment;

(b) Disclosures made to the individual, including disclosures made in response to a request for access or an accounting;

(d) Disclosures made to DHHS for the purposes of compliance and enforcement of federal regulations under 45 CFR part 160 and required for compliance with 45 CFR part 164; or

(e) Uses and disclosures required by law;

(5) When requesting protected information about an individual from another entity, the Authority shall limit requests to those that are reasonably necessary to accomplish the purposes for which the request is made. The Authority shall not request a person’s entire medical record unless the Authority can specifically justify the need for the entire medical record.

History

Statutory/Other Authority: ORS 413.042
Statutes/Other Implemented: ORS 179.505, 192.518 – 192.529, 411.010, 413.032 & 414.065
OHA 22-2011, f. & cert. ef. 9-2-11
OHA 8-2011(Temp), f. & cert. ef. 7-1-11 thru 12-27-11

Or. Admin. R. 943-014-0060 Uses and Disclosures of Protected Information for Research Purposes

The Authority may use and disclose an individual’s information for research purposes as specified in this rule.

(1) All research disclosures are subject to applicable requirements of federal and state laws and rules including but not limited to 45 CFR part 46 and 21 CFR part 50.0 to 50.56, relating to the protection of human research subjects.

(2) The Authority may use and disclose de-identified information or a limited data set for research purposes, pursuant to OAR 943-014-0070.

(3) The Authority may use and disclose information regarding an individual for research purposes with the specific written authorization of the individual. The authorization must meet all requirements in OAR 943-014-0030, and may indicate an expiration date with terms such as “end of research study” or similar language. An authorization for use and disclosure for a research study may be combined with other types of written authorization for the same research study. If research includes treatment, the researcher may require an authorization for use and disclosure for the research as a provision of providing research related treatment.

(4) Notwithstanding section (3) of this rule, the Authority may use and disclose an individual’s information for research purposes without the individual’s written authorization, regardless of the source of funding for the research, provided that:

(a) The Authority obtains documentation that a waiver of an individual’s authorization for release of information requirements has been approved by an IRB registered with the Office for Human Research Protection. Documentation required of an IRB when granting approval of a waiver of an individual’s authorization for release of information must include all criteria specified in 45 CFR part 164.512(i)(2).

(b) A researcher may request access to individual information maintained by the Authority in preparation for research or to facilitate the development of a research protocol in anticipation of research. The Authority may determine whether to permit such use or disclosure, without individual authorization or use of an IRB, pursuant to 45 CFR part 164.512(i)(1)(ii).

(c) A researcher may request access to individual information maintained by the Authority about deceased individuals. The Authority may determine whether to permit such use or disclosure of information about decedents, without individual authorization or use of an IRB, pursuant to 45 CFR part 164.512(i)(1)(iii).

(5) The Authority, as a public health authority, may obtain and use individual information without authorization for the purpose of preventing injury or controlling disease and for the conduct of public health surveillance, investigations, and interventions. The Authority may also collect, use, or disclose information, without individual authorization, to the extent that the collection, use, or disclosure is required by law. When the Authority uses information to conduct studies as a public health authority, no additional individual authorization is required nor does this rule require an IRB or privacy board waiver of authorization based on the HIPAA privacy rules.

(6) The Authority may use and disclose information without individual authorization for studies and data analysis conducted for the Authority’s own quality assurance purposes or to comply with reporting requirements applicable to federal or state funding requirements in accordance with the definition of “Health Care Operations” in 45 CFR part 164.501.

History

Statutory/Other Authority: ORS 413.042
Statutes/Other Implemented: ORS 179.505, 192.518 – 192.529, 411.010, 413.032 & 414.065
OHA 22-2011, f. & cert. ef. 9-2-11
OHA 8-2011(Temp), f. & cert. ef. 7-1-11 thru 12-27-11

Or. Admin. R. 943-014-0070 De-identification of Client Information and Use of Limited Data Sets under Data Use Agreements

(1) The Authority may use and disclose information as appropriate for the work of the Authority, without further restriction, if the Authority or another entity has taken steps to de-identify the information pursuant to 45 CFR part 164.514(a) and (b).

(2) The Authority may assign a code or other means of record identification to allow the Authority to re-identify the de-identified information provided that:

(a) The code or other means of record identification is not derived from or related to information about the individual and cannot otherwise be translated to identify the individual; and

(b) The Authority does not use or disclose the code or other means of record identification for any other purpose, and does not disclose the mechanism for re-identification.

(3) The Authority may use and disclose a limited data set if the Authority enters into a data use agreement with an entity requesting or providing the Authority with a limited data set subject to the requirements of 45 CFR part 164.514(e).

(a) The Authority may use and disclose a limited data set only for the purposes of research, public health, or health care operations. The Authority may use limited data set for its own activities or operations if the Authority has obtained a limited data set that is subject to a data use agreement.

(b) If the Authority knows of a pattern of activity or practice of a limited data set recipient that constitutes a material breach or violation of a data use agreement, the Authority shall take reasonable steps to cure the breach or end the violation. If such steps are unsuccessful, the Authority shall discontinue disclosure of information to the recipient and report the problem to the Secretary of DHHS.

History

Statutory/Other Authority: ORS 413.042
Statutes/Other Implemented: ORS 179.505, 192.518 – 192.529, 411.010, 413.032 & 414.065
OHA 22-2011, f. & cert. ef. 9-2-11
OHA 8-2011(Temp), f. & cert. ef. 7-1-11 thru 12-27-11

Or. Admin. R. 943-014-0200 Confidentiality and Inadmissibility of Mediation Communications

Pursuant to ORS 36.224(4), amending the Oregon Health Authority rule Confidentiality and Mediation Communications 943-014-0200 to adopt by reference the Confidentiality and Inadmissibility of Mediation Communications rule OAR 137-005-0052 adopted by the Attorney General effective as of 10-27-15.

History

Statutory/Other Authority: ORS 36.224, OL 2015 & ch 114 (SB 189)
Statutes/Other Implemented: ORS 36.224, 36.228, 36.230, 36.232, OL 2015 & ch 114 (SB 189)
OHA 1-2017, f. & cert. ef. 5-17-17
OHA 25-2011, f. 10-31-11, cert. ef. 11-1-11
OHA 9-2011(Temp), f. & cert. ef. 7-1-11 thru 12-27-11

Or. Admin. R. 943-014-0205 Confidentiality and Inadmissibility of Workplace Interpersonal Dispute Mediation Communications

Pursuant to ORS 36.224(4), adopting the Oregon Health Authority rule Confidentiality and Inadmissibility of Workplace Interpersonal Dispute Mediation Communications 943-014-0205 to adopt by reference the Confidentiality and Inadmissibility of Workplace Interpersonal Mediation Communications rule OAR 137-005-0054 adopted by the Attorney General effective as of 10-27-15.

History

Statutory/Other Authority: ORS 36.224, OL 2015 & ch 114 (SB 189)
Statutes/Other Implemented: ORS 36.230(4), OL 2015 & ch 114 (SB 189)
OHA 1-2017, f. & cert. ef. 5-17-17
OHA 25-2011, f. 10-31-11, cert. ef. 11-1-11
OHA 9-2011(Temp), f. & cert. ef. 7-1-11 thru 12-27-11

Or. Admin. R. 943-014-0300 Scope

These rules (OAR 943-014-0300 through 943-014-0320) apply to an organization or individual seeking or receiving access to Authority information assets or network and information systems for the purpose of carrying out a business transaction between the Authority and the user.

(1) These rules are intended to complement, and not supersede, access control or security requirements in the Authority's Electronic Data Transmission rules, OAR 943-120-0100 to 943-120-0200, and whichever rule is more specific shall control.

(2) The confidentiality of specific information and the conditions for use and disclosure of specific information are governed by other laws and rules, including but not limited to the Authority's rules for the privacy of protected information, OAR 943-014-0000 to 943-014-0070.

History

Statutory/Other Authority: ORS 413.042
Statutes/Other Implemented: ORS 182.122
OHA 27-2011, f. & cert. ef. 12-1-11
OHA 16-2011(Temp), f. & cert. ef. 8-9-11 thru 2-2-12

Or. Admin. R. 943-014-0305 Definitions

For purpose of these rules, the following terms have definitions set forth below. All other terms not defined in this section shall have the meaning used in the Health Insurance Portability and Accountability Act (HIPAA) security rules found at 45 CFR § 164.304:

(1) "Access" means the ability or the means necessary to read, communicate, or otherwise use any Authority information asset.

(2) "Access Control Process" means Authority forms and processes used to authorize a user, identify their job assignment, and determine the required access.

(3) "Authority" means the Oregon Health Authority.

(4) "Client Records" means any client, applicant, or participant information regardless of the media or source, provided by the Authority to the user, or exchanged between the Authority and the user.

(5) "Incident" means the attempted or successful unauthorized access, use, disclosure, modification, or destruction of any network and information system or Authority information asset including, but not limited to unauthorized disclosure of information; failure to protect user's identification (ID) provided by the Authority; or, theft of computer equipment that uses or stores any Authority information asset.

(6) "Information Asset" means any information, also known as data, provided through the Authority, regardless of the source or media, which requires measures for security and privacy of the information.

(7) "Network and Information System" means the State of Oregon's computer infrastructure, which provides personal communications, client records and other sensitive information assets, regional, wide area and local area networks, and the internetworking of various types of networks on behalf of the Authority.

(8) "User" means any individual authorized by the Authority to access a network and information system or information asset.

(9) "Organization" means any entity authorized by the Authority to access a network and information system or information asset.

History

Statutory/Other Authority: ORS 413.042
Statutes/Other Implemented: ORS 182.122
OHA 27-2011, f. & cert. ef. 12-1-11
OHA 16-2011(Temp), f. & cert. ef. 8-9-11 thru 2-2-12

Or. Admin. R. 943-014-0310 Information Access

The organization or user shall utilize the Authority access control process for all requested and approved access. The Authority shall notify the user of each approval or denial. When approved, the Authority shall provide the user with a unique login identifier to access the network and information system or information asset. The Authority may authorize the use of a generic login identifier.

History

Statutory/Other Authority: ORS 413.042
Statutes/Other Implemented: ORS 182.122
OHA 27-2011, f. & cert. ef. 12-1-11
OHA 16-2011(Temp), f. & cert. ef. 8-9-11 thru 2-2-12

Or. Admin. R. 943-014-0315 Security Information Assets

(1) No organization or user shall access an information asset for any purpose other than that specifically authorized by the Authority access control process.

(2) Except as specified or approved by the Authority, no organization or user shall alter, delete, or destroy any information asset.

(3) The organization shall prohibit unauthorized access by their staff, contractors, agents, or others to the network and information systems, or Authority information assets, and shall implement safeguards to prevent unauthorized access in accordance with section (4) of this rule.

(4) The organization shall develop a security risk management plan. The organization shall ensure that the plan includes, but is not limited to the following:

(a) Administrative, technical, and physical safeguards commonly found in the International Standards Organization 27002: 2005 security standard or National Institute of Standards and Technology (NIST) 800 Series;

(b) Standards established in accordance with HIPAA Security Rules, 45 CFR Parts 160 and 164, applicable to an organization or user regarding the security and privacy of a client record, any information asset, or network and information system;

(d) Controls and safeguards that address the security of equipment and storage of any information asset accessed to prevent inadvertent destruction, disclosure, or loss;

(e) Controls and safeguards that ensure the security of an information asset, regardless of the media, as identified below:

(A) The user keeps Authority-assigned access control requirements such as identification of authorized users and access control information (passwords and personal identification numbers (PIN's)), in a secure location until access is terminated;

(B) Upon request of the Authority, the organization makes available all information about the user’s use or application of the access controlled network and information system or information asset; and

(C) The organization or user ensures the proper handling, storage, and disposal of any information asset obtained or reproduced, and, when the authorized use of that information ends, is consistent with any applicable record retention requirements.

(f) Existing security plans developed to address other regulatory requirements, such as Sarbanes-Oxley Act of 2002 (PL 107-204), Title V of Gramm Leach Bliley Act of 1999, Statement on Auditing Standards (SAS) number 70, will be deemed acceptable as long as they address the above requirements.

(5) The Authority may request additional information related to the organization’s security measures.

(6) The organization or user must immediately notify the Authority when access is no longer required, and immediately cease access to or use of all information assets or network and information systems.

History

Statutory/Other Authority: ORS 413.042
Statutes/Other Implemented: ORS 182.122
OHA 27-2011, f. & cert. ef. 12-1-11
OHA 16-2011(Temp), f. & cert. ef. 8-9-11 thru 2-2-12

Or. Admin. R. 943-014-0320 User Responsibility

The organization or user shall not make any root level changes to any Authority or State of Oregon network and information system. The Authority recognizes that some application users have root level access to certain functions to allow the user to diagnose problems (such as startup or shutdown operations, disk layouts, user additions, deletions or modifications, or other operation) that require root privileges. This access does not give the user the right to make any changes normally restricted to root without explicit written permission from the Authority.

(1) Use and disclosure of any Authority information asset is strictly limited to the minimum information necessary to perform the requested and authorized service.

(2) The organization shall have established privacy and security measures that meet or exceed the standards set forth in the Authority privacy and information security policies, available from the Authority, regarding the disclosure of an information asset.

(3) The organization or user shall comply with all security and privacy federal and state laws, rules, and regulations applicable to the access granted.

(4) The organization shall make the security risk plan available to the Authority for review upon request.

(5) The organization or user shall report to the Authority all privacy or security incidents by the user that compromise, damage, or cause a loss of protection to the Authority information assets or the network and information systems. The incident report shall be made no later than five business days from the date on which the user becomes aware of such incident. The user shall provide the Authority a written report which must include the results of the incident assessment findings and resolution strategies.

(6) Wrongful use of a network and information system, or wrongful use or disclosure of an Authority information asset by the organization or user may cause the immediate suspension or revocation of any access granted, at the sole discretion of the Authority without advance notice.

(7) The organization or user shall comply with the Authority's request for corrective action concerning a privacy or security incident and with laws requiring mitigation of harm caused by the unauthorized use or disclosure of confidential information, if any.

History

Statutory/Other Authority: ORS 413.042
Statutes/Other Implemented: ORS 182.122
OHA 27-2011, f. & cert. ef. 12-1-11
OHA 16-2011(Temp), f. & cert. ef. 8-9-11 thru 2-2-12

Or. Admin. R. 943-014-0400 Purpose

These rules set requirements for contractors who are business associates of the health care component of the Oregon Health Authority (Authority) as described in OAR 943-014-0015. Business associates must comply with these rules, the business associate provisions of the Health Insurance Portability and Accountability Act (HIPAA) and HIPAA’s implementing regulations. HIPAA requires covered entities to comply with the requirements set forth in 45 CFR 164.502(e) and 164.504(e) by obtaining certain written assurances from the business associates.

History

Statutory/Other Authority: ORS 413.042
Statutes/Other Implemented: ORS 179.505, 192.553, 192.556 - 192.581, 413.032, 413.042 & 414.065
OHA 1-2014, f. 2-12-14, cert. ef. 2-18-14
OHA 1-2013(Temp), f. & cert. ef. 8-23-13 thru 2-18-14

Or. Admin. R. 943-014-0410 Definitions

As used in OAR 943-014-0400 through 943-014-0465 the following definitions apply. Terms not defined here shall have the same meaning given those terms in the Privacy Rule and the Security Rule, 45 CFR 160 and 164.

(1) “Authority” means the Oregon Health Authority.

(2) “Breach” has the meaning given that term in 45 CFR 164.402.

(3) "Business associate" has the meaning given that term in 45 CFR 160.103.

(4) "Contract" means the written agreement between the Authority and a contractor describing the rights and obligations of the parties.

(5) "Covered entity" has the meaning given that term in 45 CFR 160.103.

(6) “Electronic media” means:

(a) Data stored in electronic format; and

(b) Transmission media used to exchange information already stored in electronic format.

(7) “Electronic protected health information” (EPHI) has the meaning given that term in 45 CFR 160.103.

(8) "HIPAA" means the Health Insurance Portability and Accountability Act of 1996, 42 USC 1320d - 1320d-8, Public Law 104-191, sec. 262 and sec. 264.

(9) “HITECH Act” means the Health Information Technology for Economic and Clinical Health Act, Title XIII of division A and Title IV of Division B of the American Recovery and Reinvestment Act of 2009, Public Law 111-5, including any implementing regulations.

(10) "Privacy rule" means the Standards for Privacy of Individually Identifiable Health Information at 45 CFR part 160 and part 164, subparts A and E.

(11) “Protected health information” (PHI) has the meaning given that term in 45 CFR 160.103.

(12) “Required by law” has the meaning given that term in 45 CFR 164.103.

(13) “Secretary” means the Secretary of Health and Human Services (HHS) or designee.

(14) “Security rule” means the security standards for electronic protected health information found at 45 CFR Parts 160, and 164.

(15) “Unsecured protected health information” has the meaning given that term in 45 CFR 164.402

History

Statutory/Other Authority: ORS 413.042
Statutes/Other Implemented: ORS 179.505, 192.553, 192.556 - 192.581, 413.032, 413.042 & 414.065
OHA 1-2014, f. 2-12-14, cert. ef. 2-18-14
OHA 1-2013(Temp), f. & cert. ef. 8-23-13 thru 2-18-14

Or. Admin. R. 943-014-0415 General Business Associate Requirements

A contractor who is a business associate of the Authority shall:

(1) Not use or disclose protected health information or electronic protected health information except as permitted or required by these rules and the contract, or as required by law.

(2) Use appropriate safeguards, and comply with Subpart C of 45 CFR Part 164 with respect to electronic protected health information to prevent use or disclosure of protected health information other than as provided for by these rules and the contract.

(3) Mitigate, to the extent practicable, any known harmful effect of a use or disclosure of protected health information or electronic protected health information by the business associate in violation of the requirements of these rules and the contract.

(4) Report to the Authority any use or disclosure of protected health information or electronic protected health information not provided for by these rules and the contract as soon as possible after the contractor becomes aware of the use or disclosure.

(5) Ensure that any agent or subcontractor that creates, receives, maintains or transmits protected health information on behalf of the contractor, agrees to the same restrictions and conditions that apply to the business associate through these rules and the contract with respect to the information created, received, maintained or transmitted on behalf of the contractor.

(6) Provide access, as directed by the Authority and in the time and manner designated by the Authority, to protected health information or electronic protected health information in a designated record set to the Authority or to an individual in compliance with the requirements of 45 CFR 164.524.

(7) Make any amendment to protected health information or electronic protected health information in a designated record set that the Authority directs or agrees to pursuant to 45 CFR 164.526. These amendments will be made in the manner designated by the Authority within 10 business days of receiving direction from the Authority.

(8) Make available internal practices, books, and records, including policies and procedures relating to the use and disclosure of protected health information and electronic protected health information created, received, maintained or transmitted by the business associate on behalf of the Authority. These items must be available to the Authority and to the Secretary, in a time and manner designated by the Authority or the Secretary, for purposes of the Secretary determining the Authority’s compliance with the Privacy Rule or Security Rule.

(9) Document disclosures of protected health information and electronic protected health information and information related to such disclosures as may be required for the Authority to respond to a request by an individual for an accounting of disclosures in accordance with 45 CFR 164.528.

(10) Provide the Authority or an individual, within 10 business days of receiving direction from the Authority in a manner designated by the Authority, information collected in accordance with OAR 943-014-0415(9) to permit the Authority to respond to an individual’s request for an accounting of disclosures in accordance with 45 CFR 164.528.

History

Statutory/Other Authority: ORS 413.042
Statutes/Other Implemented: ORS 179.505, 192.553, 192.556 - 192.581, 413.032, 413.042 & 414.065
OHA 1-2014, f. 2-12-14, cert. ef. 2-18-14
OHA 1-2013(Temp), f. & cert. ef. 8-23-13 thru 2-18-14

Or. Admin. R. 943-014-0420 Uses and Disclosures of Protected Health Information by Business Associate

(1) Except as otherwise limited or prohibited by the contract or these rules, a contractor who is a business associate of the Authority may:

(a) Use or disclose protected health information and electronic protected health information to perform functions, activities, or services as specified in the contract and these rules on behalf of the Authority.

(b) Use protected health information and electronic protected health information for the proper management and administration of the business associate contract or to carry out the business associate’s legal responsibilities.

(c) Disclose protected health information and electronic protected health information for the proper management and administration of the business associate, provided disclosures are required by law.

(d) Disclose protected health information and electronic protected health information to a subcontractor if the business associate and subcontractor enter into a business associate agreement that complies with this rule.

(e) Use or disclose protected health information and electronic protected health information to report violations of law to appropriate federal and state authorities, consistent with 45 CFR 164.502(j)(1).

(2) All other use or disclosure of protected health information and electronic protected health information are prohibited.

(3) A contractor who is a business associate of the Authority may not aggregate or compile the Authority's protected health information or electronic protected health information with the protected health information or electronic protected health information of other covered entities unless the contract permits data aggregation services.

(a) If the contract permits a business associate to provide data aggregation services, a business associate may use protected health information to provide data aggregation services requested by the Authority as permitted by 45 CFR 164.504(e)(2)(i)(B) and subject to any limitations contained in these rules.

(b) If the Authority requests data aggregation services, a business associate may aggregate the Authority’s protected health information with protected heath information of other covered entities that the business associate has in its possession through its capacity as a business associate to other covered entities.

(c) The business associate may only aggregate data for the purpose of providing the Authority with analysis relating to the Authority’s health care operations.

(4) Business associates may not disclose the Authority’s protected health information to another covered entity without the Authority’s express authorization.

(5) Use or disclosure of protected health information or electronic protected health information in accordance with any section of this rule may not violate the Privacy Rule, Security Rule, the HITECH Act, or other applicable federal or state laws or regulations or the minimum necessary policies and procedures of the Authority.

History

Statutory/Other Authority: ORS 413.042
Statutes/Other Implemented: ORS 179.505, 192.553, 192.556 - 192.581, 413.032, 413.042 & 414.065
OHA 1-2014, f. 2-12-14, cert. ef. 2-18-14
OHA 1-2013(Temp), f. & cert. ef. 8-23-13 thru 2-18-14

Or. Admin. R. 943-014-0430 Authority Obligations

(1) To the extent that a business associate's use or disclosure of protected health information and electronic protected health information may be affected, the Authority shall notify business associate of:

(a) Limitations in its notice of privacy practices in accordance with 45 CFR 164.520. The Authority may satisfy this obligation by providing business associate with the Authority’s most current Notices of Privacy Practices.

(b) Changes in, or revocation of, permission by an individual to use or disclose protected health information or electronic protected health information.

(c) Restrictions to the use or disclosure of protected health information or electronic protected health information that the Authority has agreed to in accordance with 45 CFR 164.522.

(2) The Authority may not request that a business associate use or disclose protected health information or electronic protected health information in any manner that is not permissible under the Privacy Rule or Security Rule if done by the Authority, except as permitted by OAR 943-014-0420.

History

Statutory/Other Authority: ORS 413.042
Statutes/Other Implemented: ORS 179.505, 192.553, 192.556 - 192.581, 413.032, 413.042 & 414.065
OHA 1-2014, f. 2-12-14, cert. ef. 2-18-14
OHA 1-2013(Temp), f. & cert. ef. 8-23-13 thru 2-18-14

Or. Admin. R. 943-014-0435 Contractor Security Requirements

(1) Contractors must comply with the Security Rule’s business associate requirements for electronic protected health information and must comply with both the Privacy Rule and the Security Rule requirements applicable to a business associate.

(2) Contractors must:

(a) Implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of the protected health information and electronic protected health information that it creates, receives, maintains, or transmits on behalf of the Authority.

(b) Develop and enforce policies, procedures, and documentation standards (including designation of a security official) related to the administrative, physical, and technical safeguards that protect electronic protected health information.

(c) When required by OAR 943-014-0415(5), enter into a business associate agreement with any agent or subcontractor to ensure the agent or subcontractor agrees to implement reasonable and appropriate safeguards to protect electronic protected health information the contractor provides.

History

Statutory/Other Authority: ORS 413.042
Statutes/Other Implemented: ORS 179.505, 192.553, 192.556 - 192.581, 413.032, 413.042 & 414.065
OHA 1-2014, f. 2-12-14, cert. ef. 2-18-14
OHA 1-2013(Temp), f. & cert. ef. 8-23-13 thru 2-18-14

Or. Admin. R. 943-014-0440 Breach

(1) For the purposes of this rule a breach is considered “discovered” in accordance with 45 CFR 164.404(a)(2) and 45 CFR 164.410(2).

(2) In the event a breach of unsecured protected health information is discovered, a contractor must:

(a) Notify the Authority of the breach.

(A) The notification must be made as soon as possible and business associate shall confer with the Authority as soon as practicable thereafter.

(B) The notification must be made to the Authority no later than 30 calendar days after the discovery of breach.

(C) Notification shall include identification of each individual whose unsecured protected health information has been, or is reasonably believed to have been accessed, acquired, or disclosed during the breach.

(D) Notification shall include steps taken to mitigate harm, steps taken to reasonably ensure a like breach will not occur in the future, and any other information that may be reasonably required by the Authority for the Authority to meet its obligations.

(b) Confer with the Authority regarding preparing and issuing an appropriate notice to each individual whose unsecured protected health information has been, or is reasonably believed to have been accessed, acquired, or disclosed as a result of a breach.

(c) Confer with the Authority regarding preparing and issuing an appropriate notice to prominent media outlets within the state or local jurisdictions when the breach involves more than 500 individuals.

(d) Make the appropriate notification to media outlets and individuals affected by the breach as necessary.

(e) Confer with the Authority regarding preparing and issuing notice of the breach to the Secretary.

(A) If the breach involves 500 or more individuals, the notice to the Secretary must be provided immediately.

(B) Any breach involving less than 500 individuals shall be documented in a log and the log provided to the Secretary annually, no later than 60 calendar days after December 31 of each year.

(3) Except as set forth in section (5) of this rule, notifications required by this rule must be made without unreasonable delay and no later than 60 calendar days after the discovery of a breach.

(4) Notice must be provided in the manner and content required by 45 CFR 164.404 through 164.410.

(5) Any notification required by this rule may be delayed by a law enforcement official in accordance with the 45 CFR 164.412.

History

Statutory/Other Authority: ORS 413.042
Statutes/Other Implemented: ORS 179.505, 192.553, 192.556 - 192.581, 413.032, 413.042 & 414.065
OHA 1-2014, f. 2-12-14, cert. ef. 2-18-14
OHA 1-2013(Temp), f. & cert. ef. 8-23-13 thru 2-18-14

Or. Admin. R. 943-014-0445 Violations

(1) When the Authority learns about a business associate’s failure to comply with these rules the Authority shall notify the business associate of the rule violation and provide a reasonable opportunity for the business associate to remedy or end the violation.

(2) The Authority may terminate the contract if business associate does not cure the breach or end the violation within the time specified by the Authority.

(3) The Authority shall immediately terminate the contract if business associate has violated these rules and remedy is not possible in the Authority’s reasonable judgment.

History

Statutory/Other Authority: ORS 413.042
Statutes/Other Implemented: ORS 179.505, 192.553, 192.556 - 192.581, 413.032, 413.042 & 414.065
OHA 1-2014, f. 2-12-14, cert. ef. 2-18-14
OHA 1-2013(Temp), f. & cert. ef. 8-23-13 thru 2-18-14

Or. Admin. R. 943-014-0450 Termination of Contract

(1) Except as provided in section (2) of this rule, upon termination of the contract for any reason, the business associate shall, at the request of the Authority, return or destroy all protected health information and electronic protected health information created, maintained or received by the business associate from the Authority or on the Authority’s behalf.

(a) This section shall apply to protected health information and electronic protected health information that is in the possession of subcontractors or agents of the business associate.

(b) Business associate may not retain copies of the protected health information and electronic protected health information.

(2) If the business associate determines that returning or destroying the protected health information or electronic protected health information is not feasible, the business associate shall provide the Authority notification of the conditions that make return or destruction not feasible.

(a) Upon the Authority's written acknowledgement that return or destruction of protected health information or electronic protected health information is not feasible, the business associate shall continue to provide the protections to the information required by these rules and the contract.

(b) Business associate shall limit further uses and disclosures of the information to those purposes that make the return or destruction not feasible, for as long as the business associate maintains the protected information.

History

Statutory/Other Authority: ORS 413.042
Statutes/Other Implemented: ORS 179.505, 192.553, 192.556 - 192.581, 413.032, 413.042 & 414.065
OHA 1-2014, f. 2-12-14, cert. ef. 2-18-14
OHA 1-2013(Temp), f. & cert. ef. 8-23-13 thru 2-18-14

Or. Admin. R. 943-014-0455 Order of Precedence

(1) These rules shall be interpreted as broadly as necessary to implement and comply with HIPAA, the Privacy Rule, the Security Rule, and the HITECH Act.

(2) Any ambiguity in these rules shall be resolved in favor of a meaning that complies and is consistent with HIPAA, the Privacy Rule, the Security Rule, and the HITECH Act.

(3) Any ambiguity in the contract shall be resolved to permit the Authority and business associate to implement and comply with HIPAA, the HITECH Act, the Privacy Rule and the Security Rule.

(4) If a conflict arises between these rules and the provisions of the contract, these rules shall control.

(5) If a conflict arises between the provisions of the contract and the Privacy Rule, the Security Rule, or the HITECH Act, the Privacy Rule, the Security Rule, and the HITECH Act shall control.

(6) If conflict arises between these rules and the Privacy Rule, Security Rule, or HITECH Act, the Privacy Rule, Security Rule, and the HITECH Act shall control.

(7) These rules shall not supersede any other federal or state law or regulation governing the legal relationship of the parties, or the confidentiality of records or information, except to the extent that HIPAA and the HITECH Act preempt those laws or regulations.

History

Statutory/Other Authority: ORS 413.042
Statutes/Other Implemented: ORS 179.505, 192.553, 192.556 - 192.581, 413.032, 413.042 & 414.065
OHA 1-2014, f. 2-12-14, cert. ef. 2-18-14
OHA 1-2013(Temp), f. & cert. ef. 8-23-13 thru 2-18-14

Or. Admin. R. 943-014-0460 Authority Compliance Methods

The Authority may comply with these rules:

(1) By incorporating the business associate requirements contained in this rule into its contracts with business associates or by referencing these rules.

(2) By entering into a memorandum of understanding that accomplishes the objectives of these rules and meets the business associate requirements of the Privacy Rule and Security Rule, if the business associate is a government entity.

(3) By executing an amendment or rider that contains the contract provisions required by these rules or references to these rules and that amends the Authority’s contract with the business associate.

History

Statutory/Other Authority: ORS 413.042
Statutes/Other Implemented: ORS 179.505, 192.553, 192.556 - 192.581, 413.032, 413.042 & 414.065
OHA 1-2014, f. 2-12-14, cert. ef. 2-18-14
OHA 1-2013(Temp), f. & cert. ef. 8-23-13 thru 2-18-14

Or. Admin. R. 943-014-0465 Standards in Individual Contracts

(1) The Authority and a business associate may enter into a contract that contains more strict standards than those set forth in these rules as long as the standards do not violate the requirements of the Privacy Rule, Security Rule, or the HITECH Act, and the contract receives approval from the Oregon Department of Justice.

(2) If the Authority and a business associate enter into a contract containing more strict standards than those set forth in these rules, the business associate shall require subcontractors who are business associates to comply with the stricter standards.

History

Statutory/Other Authority: ORS 413.042
Statutes/Other Implemented: ORS 179.505, 192.553, 192.556 - 192.581, 413.032, 413.042 & 414.065
OHA 1-2014, f. 2-12-14, cert. ef. 2-18-14
OHA 1-2013(Temp), f. & cert. ef. 8-23-13 thru 2-18-14

Division 45 ABUSE INVESTIGATIONS AND SAFETY

Or. Admin. R. 943-045-0000 Adult Abuse Investigations, Assessing Protective Services and Review of Abuse Findings for Mental Health Services

The standards and procedures for the investigation of abuse, assessment for protective services and review of abuse findings are available at OAR chapter 419 as follows.

(1) Effective September 1, 2017 for adult community mental health programs and mental health residential treatment services, including adult foster homes, in OAR chapter 419, division 110.

(2) Effective April 13, 2018 for the state hospitals in OAR chapter 419, division 120.

(3) Effective March 1, 2019 for requesting a contested case hearing in OAR 419-050-0000 and use of lay representatives in OAR 419-050-0010.

(4) Effective January 1, 2020 for adult residential treatment services for a substance use disorder and recovery, and Oregon Department of Human Services review of substantiated abuse findings in OAR chapter 419, division 130.

History

Statutory/Other Authority: ORS 179.040 & 413.042
Statutes/Other Implemented: ORS 179.390, 426.385, 427.031, 430.210 & 430.731 to 430.768
OHA 7-2023, minor correction filed 12/01/2023, effective 12/01/2023
OHA 3-2021, amend filed 06/22/2021, effective 06/22/2021
Suspended by OHA 2-2017(Temp), f. & cert. ef. 9-14-17 thru 2-28-18
OHA 28-2011, f. 12-1-11, cert. ef. 12-4-11
OHA 10-2011(Temp), f. & cert. ef. 7-1-11 thru 12-27-11

Division 60 PUBLIC CONTRACTING AND PROCUREMENT

Or. Admin. R. 943-060-0000 Application

These rules (OAR 943-060-0000 to 943-060-0120) govern public contracting of the Oregon Health Authority and are subject to ORS chapters 279A, 279B, and 279C.

History

Statutory/Other Authority: ORS 413.042
Statutes/Other Implemented: ORS 179.040, 279A.065, 413.033 & 413.042
OHA 5-2012, f. & cert. ef. 8-1-12

Or. Admin. R. 943-060-0010 Definitions

Unless the context requires otherwise, the following definitions apply:

(1) “Authority” means the Oregon Health Authority.

(2) “Client” means any individual, family, or provider:

(a) For whom the Authority provides services and incidental or specialized goods, in any combination thereof, according to state, federal law, rule, and policy. Services and incidental goods include but are not limited to treatment, care, protection, and support without regard to the proximity of the services being provided;

(b) Who receives and utilizes services provided by the Authority primarily for that individual's or family's benefit;

(d) Who provides direct care or services and is a proxy or representative of a non-provider client.

(3) “Client services” means any service that primarily supports a client, whether the client is the recipient of voluntary or mandatory services. Client services also means any goods that are incidental or specialized in relation to any service defined in this section. Client services does not include benefits or services provided as a condition of employment with the Authority. Client services may include but are not limited to:

(a) Housing, including assistance to pay rent, mortgage, or utilities;

(b) Nutrition;

(d) Employment training or skills training to improve employability;

(e) Services for individuals with disabilities;

(f) Foster care or foster care facilities;

(g) Residential care or residential care facilities;

(h) Community housing;

(i) In-home care, including home delivered meals;

(j) Medical care, services and treatment, including but not limited to:

(A) Medical, dental, hospital, psychological, psychiatric, therapy, and vision;

(B) Alcohol and drug treatment;

(D) Drugs, prescriptions and non-prescription; or

(E) Nursing services and facilities.

(k) Transportation or relocation;

(L) Quality of life, living skills training;

(m) Personal care;

(n) Legal services and expert witness services;

(o) Religious practices, traditions and services, separately or in any combination thereof; and

(p) Educational services.

(4) “Designated Procurement Officer (DPO)” means the individual designated and authorized by the Authority’s Director to perform certain procurement functions described in these rules. If the Director does not authorize an individual as a DPO, then the Director acts in place of the DPO.

(5) “Director” means the Director of the Oregon Health Authority.

(6) “Electronic procurement system” means the Oregon Procurement Information Network (ORPIN) or other system approved by the Authority that individuals may access through the Internet that enables individuals to send electronic offers and enables the Authority to post electronic advertisements, receive electronic offers, and conduct other activities related to a procurement.

(7) “Emergency” means circumstances that:

(a) Could not have been reasonably foreseen;

(b) Create a substantial risk of loss, damage, or interruption of services or a substantial threat to property, public health, welfare, or safety; and

(8) “Goods” means supplies, equipment, or materials, and any personal property, including any tangible, intangible, and intellectual property and rights and licenses in relation thereto, that the Authority is authorized by law to procure.

(9) “Oregon Procurement Information Network (ORPIN)” means the official publication forum for procurement notices and advertisements.

(10) “Personal services” means specialized skills, knowledge, and resources in the application of technical or scientific expertise, or the exercise of professional, artistic, or management discretion or judgment, including without limitation a contract for the services of an accountant, physician or dentist, educator, information technology professional, consultant, broadcaster, or artist (including a photographer, filmmaker, painter, weaver, or sculptor). Personal services also includes client services and services of an architect, engineer, land surveyor, or provider of related services as defined in ORS 279C.100.

(11) “Procurement” means the act of purchasing, leasing, renting, or otherwise acquiring or selling goods and services; architectural, engineering and land surveying services, and related services; and public improvements. Procurement includes each function and procedure undertaken or required to be undertaken by the Authority to enter into a public contract, administer a public contract and obtain the performance of a public contract under the public contracting code and these rules. Procurement includes contract administration.

(12) “Procurement file” means any solicitation, contract, amendment, work order, or contract administration files, separately or collectively.

(13) “Public contract” is defined in ORS 279A.010 and means a sale or other disposal, or a purchase, lease, rental, or other acquisition of goods and services, public improvements, public works, minor alterations, or ordinary repair or maintenance necessary to preserve a public improvement. Public contract does not include grants. For the purposes of these rules, public contract means a contract.

(14) “Services” mean services other than personal services designated under ORS 279A.055, except for state contracting agencies with procurement authority under 279A.050 or 279A.140, services includes personal services as designated by the state contracting agencies.

(15) “Solicitation document” means the solicitation document and all documents either attached or incorporated by reference and any changes thereto, used for any of the methods according to ORS 279A.200 through 279A.220, 279B.055 through 279B.085, 279C.100 through 279C.125, or 279C.300 through 279C.450.

(16) “Special procurement” means a sourcing method and may be a class special procurement, a contract-specific special procurement, or both.

(a) “Class special procurement” is defined in ORS 279B.085 and means a contracting procedure that differs from the procedures described in ORS 279B.055, 279B.060, 279B.065, and 279B.070 and is for the purpose of entering into a series of contracts over time for the acquisition of a specified class of goods and services.

(b) “Contract-specific special procurement” means a contracting procedure that differs from the procedures described in ORS 279B.055, 279B.060, 279B.065, and 279B.070 and is for the purpose of entering into a single contract or a number of related contracts for the acquisition of specified goods and services on a one-time basis or for a single project.

(17) “Statewide price agreement” means a price agreement issued by the Department of Administrative Services on behalf of all state agencies. Such agreements may be mandatory or voluntary for use. Such agreements may result from a cooperative procurement. The Authority may not purchase goods and services through federal programs if a statewide price agreement exists for the goods and services.

History

Statutory/Other Authority: ORS 179.040, 279A.065, 279A.070, 413.014, 413.033 & 413.042
Statutes/Other Implemented: ORS 413.033
OHA 5-2012, f. & cert. ef. 8-1-12

Or. Admin. R. 943-060-0020 Procurement Authority

(1) The Authority may enter into contracts for the planning, erection, completion, and furnishing of new buildings and additions to its institutions, and may establish contracts for goods and services of all kinds necessary for the successful management and maintenance of the institutions within the Authority’s jurisdiction. The Authority may procure goods, services, personal services, construction materials, equipment, and supplies for the Authority’s institutions. The Authority may also make procurements in connection with the construction, demolition, exchange, maintenance, operation, and equipping of housing for persons with chronic mental illness.

(2) The Director of the Authority may exercise all powers necessary to effectively and expeditiously carry out procurement functions.

History

Statutory/Other Authority: ORS 179.040, 279A.065, 279A.070, 413.033 & 413.042
Statutes/Other Implemented: ORS 413.033
OHA 5-2012, f. & cert. ef. 8-1-12

Or. Admin. R. 943-060-0030 Contractor Requirements

(1) No contract or other agreement for more than $1,000 may be entered into, renewed, or extended with any individual unless the individual certifies in writing, under penalty of perjury, that the individual is not in violation of any tax laws described in ORS 305.385.

(2) A contractor who is a corporation, partnership, or who has an assumed business name shall be registered with the Oregon Secretary of State in accordance with ORS chapters 58, 60, 62, 63, 65, 67, 70, and 648. This registration is the obligation of the contractor, not the Authority.

(a) Architects, engineers, and land surveyors shall be registered with the appropriate licensing boards under the provisions of ORS 671.020, 672.020, and 672.025.

(b) The statutory requirements for contractors to register with the Oregon Secretary of State may be subject to a limited number of exceptions under federal law. For example, sole proprietors or national banks, when they contract with the Authority, are not subject to the registration requirement.

History

Statutory/Other Authority: ORS 179.040, 279A.065, 279A.070, 413.033 & 413.042
Statutes/Other Implemented: ORS 413.033
OHA 5-2012, f. & cert. ef. 8-1-12

Or. Admin. R. 943-060-0040 Independent Contractors

(1) The Authority may, within the limits of its delegation and its legislatively approved budget, contract for personal services with providers who are independent contractors.

(2) “Independent contractor” means an individual who provides services to the Authority in which the Authority neither controls nor has the right to control the means or manner by which work is performed. The Authority may control the results of the services, but not control the means or manner of how a contractor performs the work.

(3) Within the parameters of employment, workers’ compensation, and other relevant state and federal laws, and after determining that the contract will not violate any collective bargaining agreements, the Authority may contract for personal services when:

(a) The work cannot be done in a reasonable time with Authority’s own workforce;

(b) An independent and impartial evaluation is required; or

(4) The Authority may not use personal services contracts to obtain and pay for the services of an employee. If a contractor is not an independent contractor, the Authority may not enter into a personal services contract with the contractor; instead, the Authority shall follow personnel policies for employment options.

(5) The Authority shall develop a statement of work for trade or personal services, including architectural, engineering and land surveying services, and related services, that will not result in an employee relationship with the potential contractor. Contractors shall complete an independent contractor certification either as a contract provision or on a form approved by the Office of Contracts and Procurement. If the contractor cannot certify independent contractor status, the Authority shall not contract with the contractor using a trade or personal services contract, including architectural, engineering and land surveying services, and related services, except as otherwise allowed in section (5)(f) of this rule.

(a) An independent contractor certification shall be part of each contract.

(b) If the contractor is a corporation, the independent contractor certification is still required.

(c) If the nature of the services or project is such that an employee/employer relationship will exist, the Authority shall hire the individual through normal personnel procedures.

(d) The contract shall include the contractor's legal name and address. Either the contract or a separate cover sheet for the contract shall include the contractor’s social security or federal tax identification number.

(e) The contract shall provide that the contractor is responsible for federal social security, except those categories excluded by law, and for any federal or state taxes applicable to the contract payment.

(f) When a contractor cannot certify that the contractor meets the definition of independent contractor, is customarily engaged in an independently established business, and meets at least three of the requirements for such a business in accordance with ORS 670.600, the Authority may contract with the contractor only if the DPO approves the contract upon a determination that the contractor is an independent contractor and the contract will not result in undue risk to the state.

History

Statutory/Other Authority: ORS 179.040, 279A.065, 279A.070, 413.033 & 413.042
Statutes/Other Implemented: ORS 279A.070, 413.033 & 670.600
OHA 5-2012, f. & cert. ef. 8-1-12

Or. Admin. R. 943-060-0050 ORS 190 Agreements

(1) The Authority, when it enters into an agreement under ORS 190.110, 190.420, or 190.485, or an agreement under ORS 190.112 or 660.342, shall post a summary of the agreement on an applicable electronic procurement system within the 30-day period immediately following the effective date of the agreement.

(2) The summary shall include:

(a) Names of the parties to the agreement;

(b) Date of the agreement;

(d) The agency through which a person may obtain a copy of the agreement.

History

Statutory/Other Authority: ORS 179.040, 279A.065, 279A.070, 413.014, 413.033 & 413.042
Statutes/Other Implemented: ORS 279A.140(2)(h)
OHA 5-2012, f. & cert. ef. 8-1-12
OHA 1-2012(Temp), f. & cert. ef. 2-17-12 thru 8-14-12

Or. Admin. R. 943-060-0060 Contract Amendments

The Authority may amend a contract without additional competition in any of the following circumstances:

(1) The amendment is within the scope of the procurement as described in the solicitation documents, or if no solicitation documents, as described in the sole source notice or the approved special procurement or the contract, if any. The amendment is not within the scope of the procurement if the Authority determines that requested changes were not covered in the solicitation and would have likely increased competition or affected award of the contract.

(2) These rules would otherwise permit the Authority to award a contract without competition for the goods or services to be procured under the amendment.

(3) The amendment is necessary to comply with a change in law that affects performance of the contract.

(4) The amendment results from renegotiation of the terms and conditions, including the contract price, are advantageous to the Authority, subject to all of the following conditions:

(a) The goods or services to be provided under the amended contract are the same as the goods or services to be provided under the current contract;

(b) The Authority determines that, with all things considered, the amended contract is at least as favorable to Authority as the unamended contract; and

(c) The amended contract does not have a total term greater than allowed in the solicitation documents, if any, or if no solicitation documents, as described in the sole source notice or the approved special procurement, if any, after combining the initial and extended terms.

(5) The Authority may amend a contract, awarded from a solicitation, beyond its authorized term subject to the following conditions:

(a) The goods and services provided under the additional term must be reasonably related to the original contract's solicitation;

(b) Circumstances, basis, and term requested for extension amendment are outlined by program staff; and

History

Statutory/Other Authority: ORS 179.040, 279A.065, 279A.070, 413.033 & 413.042
Statutes/Other Implemented: ORS 279A.050, 279A.065(5), 279A.070, 279A.140 & 413.033
OHA 5-2012, f. & cert. ef. 8-1-12

Or. Admin. R. 943-060-0070 Payment Authorization for Cost Overruns for Services Contracts

(1) Payments on contracts for trade or personal services that exceed the maximum contract consideration (cost overruns) require approval of the DPO in accordance with section (2) of this rule. If the aggregated value of the contract, including cost overruns, exceeds $150,000, the cost overrun may also require approval from the Department of Justice under OAR 137-045-0010 to 137-045-0090.

(2) The Authority may grant approval of the payment of a cost overrun if:

(a) The original contract was duly executed and, if required, approved by the Attorney General;

(b) Payments relate to services that were provided during the term of the contract;

(d) The cost overrun arose from extraordinary circumstances or conditions encountered in the course of contract performance that were not reasonably anticipated at the time of the original contract or the most recent amendment, if any. Such circumstances include but are not limited to emergencies arising in the course of the contract that require prompt action to protect the work already completed, compliance with official or judicial commands or directives issued during contract performance, or a need to ensure that the purpose of the contract will be realized;

(e) The cost overrun was incurred in good faith, results from the good faith performance by the contractor, and is not greater than the prescribed hourly rate or the reasonable value of the additional work or performance rendered; and

(f) The aggregated value of the contract, including the cost overrun, and the contract’s objective are within the Authority’s procurement authority and the Authority has funds available for payment under the contract.

(3) The Authority shall prepare a written report that describes the Authority's discovery of the cost overrun, the reasons for the cost overrun, and the Authority’s satisfaction of the conditions set forth in section (2) of this rule. The Authority shall maintain the report in its procurement file and make the report available upon request.

(4) The DPO approves, in writing, the payment of the overrun or such portion of the overrun amount as the DPO determines may be paid consistent with the conditions of this rule. If the DPO has signed the contract, or has immediate supervisory responsibility over performance of the contract, the DPO shall designate an alternate delegate to grant or deny written approval of payment.

History

Statutory/Other Authority: ORS 179.040, 279A.065, 279A.070, 413.033 & 413.042
Statutes/Other Implemented: ORS 279A.050 & 279A.065
OHA 5-2012, f. & cert. ef. 8-1-12

Or. Admin. R. 943-060-0080 Purchases Through Federal Programs

(1) The Authority may purchase goods and services under the federal programs identified in ORS 279A.180 without competitive sealed bidding, competitive sealed proposals, or other competition required under ORS 279B.050 to 279B.085, provided that the Authority has federal authorization to purchase through the program.

(2) To purchase through a federal program, the DPO shall document in the contract file that:

(a) The acquisition meets the Authority’s requirements;

(b) The price and other terms of the acquisition are advantageous to Authority; and

(3) The Authority may add to its contract such contract terms and conditions as required by state statutes or rules if such additions do not conflict with the federal program’s contract terms and conditions, including but not limited to prompt payment requirements, additional commercial terms, and conflict resolution.

History

Statutory/Other Authority: ORS 179.040, 279A.065, 279A.070, 413.033 & 413.042
Statutes/Other Implemented: ORS 279A.180
OHA 5-2012, f. & cert. ef. 8-1-12

Or. Admin. R. 943-060-0090 Buy Decision

(1) “Buy decision” means the decision to buy goods and services through socio-economic programs, agreements, or the open market.

(2) The Authority shall make its buy decision in the priority order set forth in sections (a) through (d). If a higher priority source satisfies a procurement, the Authority shall procure through that higher priority source and shall not elect to procure through a lower priority source.

(a) Surplus property. Promotes the efficient use of existing resources (OAR 125-050-0100 to 125-050-0400).

(b) Qualified rehabilitation facilities (QRFs). Assists individuals with disabilities through gainful employment (ORS 279.835 to 279.855 and OAR 125-055-0005 to 125-055-0045).

(d) Statewide price agreements. Promotes economy and efficiency through volume and strategic purchases.

(3) Section (2) of this rule does not apply to ORS 190 agreements that promote the use of existing state resources, including an interagency agreement, intergovernmental agreement, interstate agreement, international agreement, or tribal agreement. The Authority may elect to use an ORS 190 agreement at any time.

(4) If sections (2) and (3) of this rule do not apply, the Authority may procure goods and services through the open market, using the methods provided under the public contracting code, related rules, and policies.

(5) The Authority shall award a contract for goods and services by one of the following seven sourcing methods in accordance with the public procurement code and related rules:

(a) Competitive sealed bidding under ORS 279B.055;

(b) Competitive sealed proposals under ORS 279B.060;

(d) Intermediate procurement under ORS 279B.070;

(e) Sole-source procurement under ORS 279B.075;

(f) Emergency procurement under ORS 279B.080; or

(g) Special procurement under ORS 279B.085.

History

Statutory/Other Authority: ORS 179.040, 279A.065, 279A.070, 413.033 & 413.042
Statutes/Other Implemented: ORS 279B.050
OHA 5-2012, f. & cert. ef. 8-1-12

Or. Admin. R. 943-060-0100 Special Procurements

(1) The Authority may award a contract as a special procurement as authorized by ORS 413.033.

(2) The DPO may approve or deny special procurement requests submitted on the designated form. The special procurement request shall identify whether it is for one or more particular contracts or class of contracts. A request for a special procurement concerns the procurement process only.

(3) Special procurement requests shall contain the following:

(a) Reasons why the Authority has elected to use a special procurement and how it will benefit the Authority or the public.

(b) Findings, market research, or other documentation that the special procurement:

(A) Is unlikely to encourage favoritism in the awarding of public contracts or to substantially diminish competition for public contracts, and

(B) Either:

(i) Is reasonably expected to result in substantial cost savings to the Authority or to the public; or

(ii) Otherwise substantially promotes the public interest in a manner that could not practicably be realized by complying with requirements that are applicable under ORS 279B.055, 279B.060, 279B.065, or 279B.070 or under any related rules.

(c) The alternative process designed by the Authority shall include a description of the goods and services that are the subject of the special procurement and a procurement process, including provisions for amendment and criteria for selection.

(d) The DPO may require any additional information the DPO determines reasonably necessary to evaluate the Authority's request for approval of a special procurement.

(4) The special procurement approval is effective only after the DPO's approval of the findings and completion of the public notice required under section (5) of this rule.

(5) The public notice process and requirements are as follows:

(a) The Authority shall give public notice of the approval of its special procurement as required under ORS 279B.085(5), unless otherwise directed by the DPO, in one or more, or in any combination of, the following manners:

(A) Publish notice on the Department of Administrative Services’s electronic procurement system (ORPIN);

(B) Place notice on any Authority electronic procurement system which it may establish and maintain;

(C) Place notice in a newspaper or trade journal of general circulation in the area where the work is to be performed; or

(D) Give direct written or electronic notice to potential providers known to the Authority.

(b) The public notice shall describe the goods and services or class of goods and services to be acquired through the special procurement.

(c) Public notice of the approval of the proposed special procurement shall be given at least seven days before the award, unless fewer days are specified in the notice.

(d) The Authority may request certain information be withheld from the public notice requirement of this rule in cases where confidentiality or security may be jeopardized only according to exception under the public records law (ORS 192.410 to 192.505).

(6) An affected individual may protest the approval of a special procurement in accordance with ORS 279B.400.

(7) Any solicitation or contract resulting from a special procurement approval shall contain a reference to the approved special procurement number.

(8) If the DPO provides written approval of the proposed special procurement, the Authority shall award any contract under the special procurement in accordance with the conditions of the approval and any subsequent amendments to the approval. The approval may include conditions, including but not limited to expiration, public notice, and dollar limitations, and may be revoked at any time by the DPO.

(9) If the Authority competitively solicits, it shall comply with the process described in the special procurement or the rules for that method of solicitation under ORS 279B.055 to 279B.075 and 279A.200 et seq.

(10) Nothing in this rule exempts the Authority from obtaining legal sufficiency approval from the Attorney General according to ORS 291.047.

(11) The Authority shall comply with ORS 200.035 and related policy, despite this rule.

(12) If the Authority intends to award a contract through a special procurement that calls for competition among prospective contractors, the Authority shall award the contract to the offeror the Authority determines to be the most advantageous to the Authority.

(13) The Authority shall comply with Oregon Laws 2012, chapter 53, section 4, including but not limited to:

(a) OAR 943-060-0100(12) that applies to all special procurements advertised or otherwise solicited on or after January 1, 2012.

(b) The Authority shall maintain records about its special procurements that enable the DPO to determine and provide the following information:

(A) The name of the program that conducted each special procurement;

(B) The number of special procurements conducted;

(D) A summary of the reasons the Authority decided to conduct each special procurement;

(E) A descriptive summary of the procurement procedure used to conduct the special procurement, noting whether the procedure was competitive or not;

(F) A listing of the number of offers the Authority received if the special procurement procedure was competitive;

(G) The contract price or estimated contract price for each contract awarded through a special procurement;

(H) A summary of the protests or other responses to the approval of each special procurement the Authority received; and

(I) A summary of the disposition of the protests or other responses described in section (13)(b)(H) of this rule.

History

Statutory/Other Authority: ORS 179.040, 279A.065, 279A.070, 413.033 & 413.042
Statutes/Other Implemented: ORS 179.040, 279A, (OL 2012, ch. 53, §4), 279A.050 & 279B.085
OHA 5-2012, f. & cert. ef. 8-1-12

Or. Admin. R. 943-060-0110 Special Procurements by Rule

(1) Client placement and client health care services.

(a) The Authority may use this special procurement to initiate client placement and client health care services as described in this rule prior to execution of a contract, per applicable policy. When the Authority determines a need exists to secure or maintain client placement services or to secure client health care services, the Authority may contract subject to the following definitions and conditions:

(A) “Client placement services” means securing, enhancing, or continuing the placement of a client in a structured family-like setting or residential setting operated by a qualified provider.

(B) “Client health care services” means health care services or provision of incidental or specialized supplies related to the health of a client. Client health care services include but are not limited to preventive, diagnostic, therapeutic, behavioral, rehabilitative, maintenance, palliative care, counseling, assessment, or procedure with respect to the physical or mental condition, or functional status of a client, or that affect a structure or function of the body, and the sale or dispensing of a drug, device, equipment, or other item in accordance with a prescription.

(C) Services that may prevent a placement or placement disruption but that cannot definitively be classified as client placement services by the Authority constitute client placement services and are subject to this special procurement.

(b) The Authority may not make any payments for client placement or client health care services before obtaining all requisite approvals of the contract or amendment to an existing contract.

(A) Use one of the defined source selection methods as found in ORS 279B. If the Authority elects to use one of the defined source selection methods, it shall conduct it in accordance with the public contracting code, rules, and Authority policies; or

(B) The Authority may elect to create its own source selection method. If the Authority elects to create its own source selection method, it shall document the file describing why the alternate method was selected.

(d) The Authority shall ensure all procurement personnel responsible for procuring client placement or client health care services are provided training on the conditions and limitations of this special procurement.

(2) Client services source selection.

(a) Under this class special procurement, the Authority is not required to use the source selection procedures in ORS 279B to procure client services.

(b) The Authority may competitively solicit for client services when there is known competition. Under these circumstances, the Authority may:

(A) Use one of the source selection methods in ORS 279B. If the Authority uses one of the source selection methods, it shall conduct the solicitation in accordance with the public contracting code, rules, and Authority policies; or

(B) The Authority may elect to create its own source selection method. If the Authority creates its own source selection method, it shall document the file describing why the alternate method was selected.

(3) Advertising contracts.

(a) The Authority may use this special procurement to purchase advertising, regardless of dollar value, without competitive bidding.

(b) The Authority shall use competitive methods where practicable to achieve best value and shall document in the procurement file the reasons why a competitive process was deemed to be impractical.

(4) Equipment repair and overhaul.

(a) The Authority may use this special procurement for equipment repair and overhaul, as described below.

(b) The Authority, having procurement authority according to ORS 413.033, may enter into a public contract for equipment repair or overhaul without competitive bidding, subject to the following conditions:

(A) Service or parts required are unknown and the cost cannot be determined without extensive preliminary dismantling or testing; and

(B) Service or parts required are for sophisticated equipment for which specially trained personnel are required and such personnel are available from only one source.

(c) The Authority shall use competitive methods where practicable to achieve best value and shall document in the procurement file the reasons why a competitive process was deemed to be impractical.

(5) Purchase of used personal property.

(a) Subject to the provisions of this special procurement, the Authority may purchase used property or equipment without competitive bidding and without obtaining competitive quotes.

(b) “Used personal property or equipment” means the property or equipment which has been placed in its intended use by a previous owner or user for a period of time recognized in the relevant trade or industry as qualifying the personal property or equipment as “used” at the time of the Authority purchase. Used personal property or equipment generally does not include property or equipment if the Authority was the previous user, whether under a lease, as part of a demonstration, trial or pilot project, or similar arrangement.

(c) For purchases of used personal property or equipment, the Authority shall, where feasible, obtain three quotes, unless the Authority has determined and documented that a purchase without obtaining quotes will result in cost savings to the Authority. The Authority shall obtain and keep a written record of the source and quotes received. If three quotes are not available, a written record shall be made of the attempt to obtain quotes.

(6) Speakers.

(a) The Authority may use this special procurement to enter into written agreements for speaker services, as described in this rule. When the Authority determines that a need exists to secure speaker services, the Authority may contract subject to the following definitions and conditions:

(A) “Speaker” means a provider in the role of a lecturer, presenter, keynote, or speechmaker on a topic in which he or she has expertise. A speaker addresses groups of people in a structured, deliberate manner intended to inform or influence the participants. A speaker’s role is different from the role of a trainer or facilitator.

(B) The Authority may contract with a speaker to provide lectures, presentations, or speeches one or multiple times and at a single or multiple locations.

(b) Under this class special procurement, the Authority is not required to use the source selection procedures in ORS 279B to procure speaker services when the value does not exceed $150,000.

(7) Seminar, training registration, and conference fees.

(a) The Authority may use this special procurement to enter into written agreements for seminars, training registrations, and conference fees when the Authority determines that a need exists. The Authority may contract subject to the following definitions and conditions:

(A) “Trainer” means a provider in a role that delivers professional training or seminar services that direct the growth of learners by making them qualified, informed, or proficient in a skill, task, attitude, system, or process. The trainer works from a structured design based on learning objectives. The provider may utilize coaching, instructing, and facilitating techniques to accomplish the learning objective. A trainer’s role is different from the role of a speaker or facilitator.

(B) The Authority may contract with a trainer with proprietary material essential to the business need.

(b) The Authority shall select trainers it considers most advantageous based on one or more of the following criteria:

(A) The knowledge, skills, and ability of each trainer that will provide the services;

(B) The trainer’s ability to provide services;

(D) Whether each trainer’s available personnel possess any required licenses or certifications required to perform the services for, or on behalf of, the Authority;

(E) The proprietary nature of the particular training program or materials needed by the Authority;

(F) Each trainer’s availability, capability, resources, and commitment to perform the training services at times and locations set by the Authority; or

(G) Other factors the Authority considers relevant to obtain the maximum training benefit.

(c) Under this class special procurement, the Authority is not required to use the source selection procedures in ORS 279B to procure trainer services when:

(A) The value does not exceed $150,000; and

(B) The trainer of the services owns an exclusive copyright in the training materials; or

(C) The training services are designed to be repeatedly delivered regardless of the audience and are not customized or developed specifically for each audience or event.

(8) Memberships.

(a) The Authority may use this special procurement to purchase dues or memberships in professional or community organizations, institutions, or associations, in accordance with OAR 137-045-0050(12), when the membership is for the benefit of the Authority.

(b) Under this class special procurement, the Authority is not required to use the source selection procedures in ORS 279B to procure memberships.

(9) Copyrighted materials.

(a) The Authority may use this special procurement to purchase copyrighted materials where there is only one known supplier available for such goods. This includes but is not limited to new books, workbooks, periodicals, subscriptions, curriculum materials, reference materials, and audio and visual media from a particular publisher or its designated distributor.

(b) Under this class special procurement, the Authority is not required to use the source selection procedures in ORS 279B to procure copyrighted materials.

(10) Software and hardware maintenance, licenses, and upgrades.

(a) The Authority may use this special procurement to directly enter into a contract or renew existing contracts for information technology hardware or software maintenance, licenses, and upgrades without competitive solicitation where the maintenance, upgrades, or licenses are either available from only one source or, if available from more than one provider, are obtained from the Authority’s current provider to utilize the pre-existing knowledge of the vendor regarding the specifics of the Authority’s hardware or software system.

(b) The Authority shall document in the procurement file the facts that justify either that maintenance, licenses, or upgrades were available from only one source or, if from more than one source, from the current vendor.

(11) Manufacturer direct supplies.

(a) The Authority may use this special procurement to purchase goods directly from a manufacturer if the cost from the manufacturer is the same or less than the cost the manufacturer charges to its distributors.

(b) The Authority may not use this special procurement when a statewide price agreement exists for the goods.

(12) Health care reform.

(a) The Authority may use this special procurement to enter into written agreements for consultant services to carry out the Governor’s and the Authority’s efforts to reform health care delivery via community based programs and other health care reform initiatives. When the Authority determines that a need exists to secure health care reform services, the Authority may contract subject to the following definitions and conditions:

(A) “Health care reform” means looking at ways of delivering health care services for Oregon families that improve the quality of care and develop ways to reduce the cost of health care.

(B) The Authority may contract with a consultant who has the specialized knowledge, skills, and abilities in the area of health care reform when:

(i) Federal guidelines or timelines require an expedited procurement process;

(ii) Assessments, development of policies, information systems, and other tools and documents are required to be conducted through independent analysis by third party consultants; or

(iii) The Authority risks losing federal funding or may fail to meet required deadlines to continue funding for the next phase of health care reform.

(b) The Authority is not required to use the source selection procedures in ORS 279B to procure health care reform consultant services when:

(A) The services do not exceed 12 months in duration; and

(B) The consultant is considered an expert in health care reform as determined by the Authority.

(c) The Authority will use the source selection requirements as found in ORS 279B when the consultant services do not meet the requirements under this special procurement.

(13) Accreditation services.

(a) The Authority may use this special procurement to obtain accreditation services when a program is required to have accreditation for certification of competency, authority, or credibility by an organization that is certified to grant the accreditation.

(b) The Authority is not required to use the source selection procedures in ORS 279B to procure accreditation services.

History

Statutory/Other Authority: ORS 179.040, 279A.065, 279A.070, 413.033 & 413.042
Statutes/Other Implemented: ORS 279B.085
OHA 5-2012, f. & cert. ef. 8-1-12

Or. Admin. R. 943-060-0120 Grant Authority

If the Authority is a grant recipient or grantor in an agreement, the definition of grant in ORS 279A.010 determines if the agreement is subject to the public procurement code and these rules. If the grantor or the Authority has substantial involvement in the program or activity of the Authority, the agreement is not a grant.

History

Statutory/Other Authority: ORS 179.040, 279A.065, 279A.070, 413.033 & 413.042
Statutes/Other Implemented: ORS 279A.025
OHA 5-2012, f. & cert. ef. 8-1-12

Division 120 PROVIDER RULES

Or. Admin. R. 943-120-0100 Definitions

The following definitions apply to OAR 943-120-0100 through 943-120-0200:

(1) "Access" means the ability or means necessary to read, write, modify, or communicate data or information or otherwise use any information system resource.

(2) "Agent" means a third party or organization that contracts with a provider, allied agency, coordinated care organization (CCO) or prepaid health plan (PHP), to perform designated services in order to facilitate a transaction or conduct other business functions on its behalf. Agents include billing agents, claims clearinghouses, vendors, billing services, service bureaus, and accounts receivable management firms. Agents may also be clinics, group practices, and facilities that submit billings on behalf of providers but the payment is made to a provider, including the following: an employer of a provider, if a provider is required as a condition of employment to turn over his fees to the employer; the facility in which the service is provided, if a provider has a contract under which the facility submits the claim; or a foundation, plan, or similar organization operating an organized health care delivery system, if a provider has a contract under which the organization submits the claim. Agents may also include electronic data transmission submitters.

(3) "Allied Agency" means local and regional allied agencies and includes local mental health authority, community mental health programs, Oregon Youth Authority, Department of Corrections, local health departments, schools, education service districts, developmental disability service programs, area agencies on aging, federally recognized American Indian tribes, and other governmental agencies or regional authorities that have a contract (including an interagency, intergovernmental, or grant agreement, or an agreement with an American Indian tribe pursuant to ORS 190.110) with the Oregon Health Authority to provide for the delivery of services to covered individuals and that request to conduct electronic data transactions in relation to the contract.

(4) “Authority” or “Oregon Health Authority” means the agency established in ORS Chapter 413 that administers the funds for Titles XIX and XXI of the Social Security Act. It is the single state agency for the administration of the medical assistance program under ORS chapter 414. For purposes of these rules, the agencies under the authority of the Authority are the Public Health Division, the Addictions and Mental Health Division, and the Division of Medical Assistance Programs..

(5) "Authority Network and Information Systems" means the Authority's computer infrastructure that provides personal communications, confidential information, regional, wide area and local networks, and the internetworking of various types of networks on behalf of the Authority.

(6) "Clinic" means a group practice, facility, or organization that is an employer of a provider, if a provider is required as a condition of employment to turn over his fees to the employer; the facility in which the service is provided, if a provider has a contract under which the facility submits the claim; or a foundation, plan, or similar organization operating an organized health care delivery system, if a provider has a contract under which the organization submits the claim; and the group practice, facility, or organization is enrolled with the Authority, and payments are made to the group practice, facility, or organization. If the entity solely submits billings on behalf of providers and payments are made to each provider, then the entity is an agent.

(7) "Confidential Information" means information relating to covered individuals which is exchanged by and between the Authority, a provider, CCO, PHP, clinic, allied agency, or agents for various business purposes, but which is protected from disclosure to unauthorized individuals or entities by applicable state and federal statutes such as ORS 414.679, 344.600, 410.150, 411.320, 418.130, or the Health Insurance Portability and Accountability Act of 1996, Public Law 104-191 and its implementing regulations. These statutes and regulations are collectively referred to as "Privacy Statutes and Regulations."

(8) "Contract" means a specific written agreement between the Authority and a provider, CCO, PHP, clinic, or allied agency that provides or manages the provision of services, goods, or supplies to covered individuals and where the Authority and a provider, CCO, PHP, clinic, or allied agency may exchange data. A contract specifically includes, without limitation, an Authority provider enrollment agreement, fully capitated heath plan managed care contract, dental care organization managed care contract, mental health organization managed care contract, chemical dependency organization managed care contract, physician care organization managed care contract, coordinated care organization contract, a county financial assistance agreement, or any other applicable written agreement, interagency agreement, intergovernmental agreement, or grant agreement between the Authority and a provider, CCO, PHP, clinic, or allied agency.

(9) “Coordinated Care Organization” (CCO) means an entity that has been certified by the Authority to provide coordinated and integrated health services.

(10) "Covered Entity" means a health plan, health care clearing house, health care provider who transmits any health information in electronic form in connection with a transaction covered by 45 CFR 162.100 through 162.1902, or allied agency that transmits any health information in electronic form in connection with a transaction, including direct data entry (DDE), and who must comply with the National Provider Identifier (NPI) requirements of 45 CFR 162.402 through 162.414.

(11) "Covered Individual" means individuals who are eligible for payment of certain services or supplies provided to them or their eligible dependents by or through a provider, CCO, PHP, clinic, or allied agency under the terms of a contract applicable to a governmental program for which the Authority processes or administers data transmissions.

(12) "Data" means a formalized representation of specific facts or concepts suitable for communication, interpretation, or processing by individuals or by automatic means.

(13) "Data Transmission" means the transfer or exchange of data between the Authority and a web portal or electronic data interchange (EDI) submitter by means of an information system which is compatible for that purpose and includes without limitation, web portal, EDI, electronic remittance advice (ERA), or electronic media claims (EMC) transmissions.

(14) "Department" means the Department of Human Services.

(15) "Direct Data Entry (DDE)" means the process using dumb terminals or computer browser screens where data is directly keyed into a health plan's computer by a provider or its agent, such as through the use of a web portal.

(16) "Electronic Data Interchange (EDI)" means the exchange of business documents from application to application in a federally mandated format or, if no federal standard has been promulgated, using bulk transmission processes and other formats as the Authority designates for EDI transactions. For purposes of these rules (OAR 943-120-0100 through 943-120-0200), EDI does not include electronic transmission by web portal.

(17) "Electronic Data Interchange Submitter" means an individual or entity authorized to establish the electronic media connection with the Authority to conduct an EDI transaction. An EDI submitter may be a trading partner or an agent of a trading partner.

(18) "Electronic Media" means electronic storage media including memory devices in computers or computer hard drives; any removable or transportable digital memory medium such as magnetic tape or disk, optical disk, or digital memory card; or transmission media used to exchange information already in electronic storage media. Transmission media includes but is not limited to the internet (wide-open), extranet (using internet technology to link a business with information accessible only to collaborating parties), leased lines, dial-up lines, private networks, and the physical movement of removable or transportable electronic storage media. Certain transmissions, including paper via facsimile and voice via telephone, are not considered transmissions by electronic media because the information being exchanged did not exist in electronic form before transmission.

(19) "Electronic Media Claims (EMC)" means an electronic media means of submitting claims or encounters for payment of services or supplies provided by a provider, CCO, PHP, clinic, or allied agency to a covered individual.

(20) "Electronic Remittance Advice (ERA)" means an electronic file in X12 format containing information pertaining to the disposition of a specific claim for payment of services or supplies rendered to covered individuals which are filed with the Authority on behalf of covered individuals by providers, clinics, or allied agencies. The documents include, without limitation, the provider name and address, individual name, date of service, amount billed, amount paid, whether the claim was approved or denied, and if denied, the specific reason for the denial. For CCOs or PHPs, the remittance advice file contains information on the adjudication status of encounter claims submitted.

(21) "Electronic Data Transaction (EDT)" means a transaction governed by the Health Insurance Portability and Accountability Act (HIPAA) transaction rule, conducted by either web portal or EDI.

(22) "Envelope" means a control structure in a mutually agreed upon format for the electronic interchange of one or more encoded data transmissions either sent or received by an EDI submitter or the Authority.

(23) "HIPAA Transaction Rule" means the standards for electronic transactions at 45 CFR Part 160 and 162 as revised effective January 16, 2009 (from version in effect on January 1, 2008) adopted by the Department of Health and Human Services (DHHS) to implement the Health Insurance Portability and Accountability Act of 1996, 42 USC 1320d et. seq.

(24) "Incident" means the attempted or successful unauthorized access, use, disclosure, modification, or destruction of an information system or information asset including but not limited to unauthorized disclosure of information, failure to protect user IDs, and theft of computer equipment using or storing Authority information assets or confidential information.

(25) "Individual User Profile (IUP)" means Authority forms used to authorize a user, identify their job assignment, and the required access to the Authority's network and information system. It generates a unique security access code used to access the Authority's network and information system.

(26) "Information Asset" means all information, also known as data, provided through the Authority, regardless of the source, which requires measures for security and privacy of the information.

(27) "Information System" means an interconnected set of information resources under the same direct management control that shares common functionality. A system normally includes hardware, software, information, data, applications, communications, and trained personnel necessary for successful data transmission.

(28) "Lost or Indecipherable Transmission" means a data transmission which is never received by or cannot be processed to completion by the receiving party in the format or composition received because it is garbled or incomplete, regardless of how or why the message was rendered garbled or incomplete.

(29) "Mailbox" means the term used by the Authority to indicate trading partner-specific locations on the Authority's secure file transfer protocol (SFTP) server to deposit and retrieve electronic data identified by a unique Authority assigned trading partner number.

(30) "Password" means the alpha-numeric codes and special characters assigned to an EDI submitter by the Authority for the purpose of allowing access to the Authority's information system, including the web portal, for the purpose of successfully executing data transmissions or otherwise carrying out the express terms of a trading partner agreement or provider enrollment agreement and these rules.

(31) "Personal Identification Number (PIN)" means the alpha-numeric codes assigned to web portal submitters by the Authority for the purpose of allowing access to the Authority's information system, including the web portal, for the purpose of successfully executing DDE, data transmissions, or otherwise carrying out the express terms of a trading partner agreement, provider enrollment agreement, and these rules.

(32) "Prepaid Health Plan (PHP) or Plan" means a managed health care, dental care, chemical dependency, physician care organization, or mental health care organization that contracts with the Authority on a case managed, prepaid, capitated basis under the Oregon Health Plan (OHP).

(33) "Provider" means an individual, facility, institution, corporate entity, or other organization which supplies or provides for the supply of services, goods or supplies to covered individuals pursuant to a contract, including but not limited to a provider enrollment agreement with the Authority. A provider does not include billing providers as used in the Division of Medical Assistance (DMAP) general rules but does include non -healthcare providers such as foster care homes. DMAP billing providers are defined in these rules as agents, except for DMAP billing providers that are clinics.

(34) "Provider Enrollment Agreement" means an agreement between the Authority and a provider for payment for the provision of covered services to covered individuals.

(35) "Registered Transaction" means each type of EDI transaction applicable to a trading partner that must be registered with the Authority before it can be tested or approved for EDI transmission.

(36) "Security Access Codes" means the access code assigned by the Authority to the web portal submitter or EDI submitter for the purpose of allowing access to the Authority's information system, including the web portal, to execute data transmissions or otherwise carry out the express terms of a trading partner agreement, provider enrollment agreement, and these rules. Security access codes may include passwords, PINs, or other codes. For password standards, refer to the Authority’s ISPO best practice: http://www.dhs.state.or.us/policy/admin/security/090_002.htm.

(37) "Source Documents" means documents or electronic files containing underlying data which is or may be required as part of a data transmission with respect to a claim for payment of charges for medical services or supplies provided to a covered individual, or with respect to any other transaction. Examples of data contained within a specific source document include but are not limited to an individual's name and identification number, claim number, diagnosis code for the services provided, dates of service, service procedure description, applicable charges for the services provided, and a provider's, CCOs, PHP's, clinic's, or allied agency's name, identification number, and signature.

(38) "Standard" means a rule, condition, or requirement describing the following information for products, systems, or practices:

(a) Classification of components;

(b) Specification of materials, performance, or operations; or

(39) "Standards for Electronic Transactions" mean a transaction that complies with the applicable standard adopted by DHHS to implement standards for electronic transactions.

(40) “Submitter” means a provider, CCO, PHP, clinic, or allied agency that may or may not have entered into a Trading Partner Agreement depending upon whether the need is to exchange Electronic Data Transactions or access the Authority’s Web Portal.

(41) "Transaction" means the exchange of data between the Authority and a provider using web portal access or a trading partner using electronic media to carry out financial or administrative activities.

(42) "Trade Data Log" means the complete written summary of data and data transmissions exchanged between the Authority and an EDI submitter during the period of time a trading partner agreement is in effect and includes but is not limited to sender and receiver information, date and time of transmission, and the general nature of the transmission.

(43) "Trading Partner" means a provider, CCO, PHP, clinic, or allied agency that has entered into a trading partner agreement with the Authority in order to satisfy all or part of its obligations under a contract by means of EDI, ERA, or EMC, or any other mutually agreed means of electronic exchange or transfer of data.

(44) "Trading Partner Agreement (TPA)" means a specific written request by a provider, CCO, PHP, clinic, or allied agency to conduct EDI transactions that governs the terms and conditions for EDI transactions in the performance of obligations under a contract. A provider, CCO, PHP, clinic, or allied agency that has executed a TPA will be referred to as a trading partner in relation to those functions.

(45) "User" means any individual or entity authorized by the Authority to access network and information systems or information assets.

(46) "User Identification Security (UIS)" means a control method required by the Authority to ensure that only authorized users gain access to specified information assets. One method of control is the use of passwords and PINs with unique user identifications.

(47) "Web Portal" means a site on the World Wide Web that provides secure access with personalized capabilities to its visitors and a pathway to other content designed for use with the Authority specific DDE applications.

(48) "Web Portal Submitter" means an individual or entity authorized to establish an electronic media connection with the Authority to conduct a DDE transaction. A web portal submitter may be a provider or a provider's agent.

History

Statutory/Other Authority: ORS 413.042 & 414.065
Statutes/Other Implemented: ORS 413.042 & 414.065
OHA 7-2012, f. 10-9-12, cert. ef. 10-10-12
OHA 4-2012(Temp), f. & cert. ef. 7-12-12 thru 1-6-13
OHA 26-2011, f. 10-31-11, cert. ef. 11-1-11
OHA 13-2011(Temp), f. & cert. ef. 7-1-11 thru 12-27-11

Or. Admin. R. 943-120-0110 Purpose

(1) These rules establish requirements applicable to providers, CCOs, PHPs, and allied agencies that want to conduct electronic data transactions with the Authority. These rules govern the conduct of all web portal or EDI transactions with the Authority. These rules only apply to services or items that are paid for by the Authority. If the service or item is paid for by a plan or an allied agency, these rules do not apply.

(2) These rules establish the Authority's electronic data transaction requirements for purposes of the Health Insurance Portability and Accountability Act of 1996, 42 USC 1320d–1320d-8, Public Law 104-191, sec. 262 and sec. 264, and the implementing standards for electronic transactions rules. Where a federal HIPAA standard has been adopted for an electronic data transaction, this rule implements and does not alter the federal standard.

(3) These rules establish procedures that must be followed by any provider, CCO, PHP, or allied agency in the event of a security or privacy incident, regardless of whether the incident is related to the use of an electronic data transaction.

History

Statutory/Other Authority: ORS 413.042 & 414.065
Statutes/Other Implemented: ORS 413.042 & 414.065
OHA 7-2012, f. 10-9-12, cert. ef. 10-10-12
OHA 4-2012(Temp), f. & cert. ef. 7-12-12 thru 1-6-13
OHA 26-2011, f. 10-31-11, cert. ef. 11-1-11
OHA 13-2011(Temp), f. & cert. ef. 7-1-11 thru 12-27-11

Or. Admin. R. 943-120-0112 Scope and Sequence of Electronic Data Transmission Rules

(1) The Authority communicates with and receives communications from its providers, CCOs, PHPs, and allied agencies using a variety of methods appropriate to the services being provided, the nature of the entity providing the services, and constantly changing technology. These rules describe some of the basic ways that the Authority will exchange data electronically. Additional details may be provided in the Authority's access control rules, provider-specific rules, or the applicable contract documents.

(2) Access to eligibility information about covered individuals may occur using one or more of the following methods:

(a) Automated voice response, via a telephone;

(b) Web portal access;

(d) Point of sale (POS) for pharmacy providers.

(3) Claims for which the Authority is responsible for payment or encounter submissions made to the Authority may occur using one or more of the following methods:

(a) Paper, using the form specified in the provider specific rules and supplemental billing guidance. Providers may submit paper claims, except that pharmacy providers are required to use the POS process for claims submission, and CCOs and PHPs must use the 837 electronic formats;

(b) Web portal access;

(d) POS for pharmacy providers.

(4) Authority informational updates, provider record updates, depository for CCO or PHP reports, or EDT as specified by the Authority for contract compliance.

(5) Other Authority network and information system access is governed by specific program requirements, which may include but is not limited to IUP access. Affected providers, CCOs, PHPs, and allied agencies shall be separately instructed about the access and requirements. Incidents are subject to these rules.

(6) Providers and allied agencies that continue to use only paper formats for claims transactions are only subject to the confidentiality and security rule, OAR 943-120-0170.

History

Statutory/Other Authority: ORS 413.042 & 414.065
Statutes/Other Implemented: ORS 413.042 & 414.065
OHA 7-2012, f. 10-9-12, cert. ef. 10-10-12
OHA 4-2012(Temp), f. & cert. ef. 7-12-12 thru 1-6-13
OHA 26-2011, f. 10-31-11, cert. ef. 11-1-11
OHA 13-2011(Temp), f. & cert. ef. 7-1-11 thru 12-27-11

Or. Admin. R. 943-120-0114 Provider Enrollment Agreement

(1) When a provider applies to enroll, the application form will include information about how to participate in the web portal for use of DDE and automated voice response (AVR) inquiries. The enrollment agreement shall include a section describing the process that will permit the provider, once enrolled, to participate in DDE over the Internet using the secure Authority web portal. This does not include providers enrolled through the use of the DMAP 3108 Managed Care Plan and FFS Non Paid Provider Application. CCOs and PHPs shall receive the information described in this rule, along with PINs and other information required for access.

(2) When the provider number is issued by the Authority, the provider will also receive two PINs: one that may be used to access the web portal and one that may be used for AVR.

(a) If the PINs are not activated within 60 days of issuance, the Authority will initiate a process to inactivate the PIN. If the provider wants to use PIN-based access to the web portal or AVR after deactivation, the provider must submit an update form to obtain another PIN.

(b) Activating the PIN will require Internet access and the provider must supply security data that will be associated with the use of the PIN.

(c) Providers, CCOs, and PHPs using the PIN must protect the confidentiality and security of the PIN pursuant to OAR 943-120-0170.

History

Statutory/Other Authority: ORS 413.042 & 414.065
Statutes/Other Implemented: ORS 413.042 & 414.065
OHA 7-2012, f. 10-9-12, cert. ef. 10-10-12
OHA 4-2012(Temp), f. & cert. ef. 7-12-12 thru 1-6-13
OHA 26-2011, f. 10-31-11, cert. ef. 11-1-11
OHA 13-2011(Temp), f. & cert. ef. 7-1-11 thru 12-27-11

Or. Admin. R. 943-120-0116 Web Portal Submitter

(1) Any provider, CCO, or PHP activating their web portal access for web portal submission may be a web portal submitter. The provider will be referred to as the web portal submitter when functioning in that capacity, and shall be required to comply with these rules governing web portal submitters.

(2) The authorized signer of the provider enrollment agreement shall be the individual who is responsible for the provider's, CCO’s, or PHP’s DDE claims submission process.

(a) If a provider, CCO, or PHP submits their own claims directly, the provider, CCO, or PHP will be referred to as the web portal submitter when functioning in that capacity and shall be required to comply with these rules.

(b) If a provider, CCO, or PHP uses an agent or clinic to submit DDE claims using the Authority's web portal, the agent or clinic will be referred to as the web portal submitter when functioning in that capacity and shall be required to comply with these rules.

History

Statutory/Other Authority: ORS 413.042 & 414.065
Statutes/Other Implemented: ORS 413.042 & 414.065
OHA 7-2012, f. 10-9-12, cert. ef. 10-10-12
OHA 4-2012(Temp), f. & cert. ef. 7-12-12 thru 1-6-13
OHA 26-2011, f. 10-31-11, cert. ef. 11-1-11
OHA 13-2011(Temp), f. & cert. ef. 7-1-11 thru 12-27-11

Or. Admin. R. 943-120-0118 Conduct of Direct Data Entry Using Web Portal

(1) The web portal submitter is responsible for the conduct of the DDE transactions submitted on behalf of the provider, CCO, or PHP, as follows:

(a) The web portal submitter must take reasonable care to ensure that data and DDE transmissions are timely, complete, accurate, and secure, and must take reasonable precautions to prevent unauthorized access to the information system or the DDE transmission. The Authority may not correct or modify an incorrect DDE transaction prior to processing. The transactions may be rejected and the web portal submitter shall be notified of the rejection.

(b) The web portal submitter and the Authority must bear their own information system costs. The web portal submitter must, at their own expense, obtain access to Internet service that is compatible with and has the capacity for secure access to the Authority's web portal. Web portal submitters must pay their own costs for all charges, including but not limited to charges for equipment, software and services, Internet connection and use time, terminals, connections, telephones, and modems. The Authority is not responsible for providing technical assistance for access to or use of Internet web portal services or the processing of a DDE transaction.

(c) The web portal submitter must send and receive all data transactions in the Authority's approved format. Any attempt to modify or alter the DDE transaction format may result in denial of web portal access.

(d) Re-submissions. The web portal submitter must maintain source documents and back-up files or other means sufficient to re-create a data transmission in the event that re-creation becomes necessary for any purpose, within timeframes required by federal or state law, or by contractual agreement. Back ups, archives, or related files are subject to the terms of these rules to the same extent as the original data transmission.

(2) To protect security and confidentiality, web portal submitters must comply with the following:

(a) Refrain from copying, reverse engineering, disclosing, publishing, distributing, or altering any data or data transmissions, except as permitted by these rules or the contract, or use the same for any purpose other than that which the web portal submitter was specifically given access and authorization by the Authority or the provider.

(b) Refrain from obtaining access by any means to any data or the Authority's network and information system for any purpose other than that which the web portal submitter has received express authorization to receive access. If the web portal submitter receives data or data transmissions from the Authority which are clearly not intended for the receipt of web portal submitter, the web portal submitter will immediately notify the Authority and make arrangements to return or re-transmit the data or data transmission to the Authority. After re-transmission, the web portal submitter must immediately delete the data contained in the data transmission from its information system.

(c) Install necessary security precautions to ensure the security of the DDE transmission or records relating to the information system of either the Authority or the web portal submitter when the information system is not in active use by the web portal submitter.

(d) Protect and maintain, at all times, the confidentiality of security access codes issued by the Authority. Security access codes are strictly confidential and specifically subject, without limitation, to all of the restrictions in OAR 943-120-0170. The Authority may change the designated security access codes at any time and in any manner as the Authority in its sole discretion considers necessary.

History

Statutory/Other Authority: ORS 413.042 & 414.065
Statutes/Other Implemented: ORS 413.042 & 414.065
OHA 7-2012, f. 10-9-12, cert. ef. 10-10-12
OHA 4-2012(Temp), f. & cert. ef. 7-12-12 thru 1-6-13
OHA 26-2011, f. 10-31-11, cert. ef. 11-1-11
OHA 13-2011(Temp), f. & cert. ef. 7-1-11 thru 12-27-11

Or. Admin. R. 943-120-0120 Registration Process — EDI Transactions

(1) The EDI transaction process is preferred by providers, CCOs, PHPs, and allied agencies for conducting batch or real time transactions, rather than the individual data entry process used for DDE. EDI registration is an administrative process governed by these rules. The EDI registration process begins with the submission of a TPA by a provider, CCO, PHP, clinic, or allied agency, including all requirements and documentation required by these rules.

(2) Trading partners must be Authority providers, CCOs, PHPs, clinics, or allied agencies with a current Authority contract. The Authority will not accept a TPA from individuals or entities who do not have a current contract with the Authority; however, the Authority shall accept a TPA from entities that have been provisionally certified to become CCOs in order to facilitate testing, pending contract signing.

(a) The Authority may receive and hold the TPA for individuals or entities that have submitted a provider enrollment agreement or other pending contract, subject to the satisfactory execution of the pending document.

(b) Termination, revocation, suspension, or expiration of the contract will result in the concurrent termination, revocation, suspension, or expiration of the TPA without any additional notice; except that the TPA will remain in effect to the extent necessary for a trading partner or the Authority to complete obligations involving EDI under the contract for dates of service when the contract was in effect. Contracts that are periodically renewed or extended do not require renewal or extension of the TPA unless there is a lapse of time between contracts.

(c) Failure to identify a current Authority contract during the registration process shall result in a rejection of the TPA. The Authority shall verify that the contract numbers identified by a provider, CCO, PHP, clinic, or allied agency are current contracts.

(d) If contract number or contract status changes, the trading partner must provide the Authority with updated information within five business days of the change in contract status. If the Authority determines that a valid contract no longer exists, the Authority shall discontinue EDI transactions applicable for any time period in which the contract no longer exists; except that the TPA will remain in effect to the extent necessary for the trading partner or the Authority to complete obligations involving EDI under the contract for dates of service when the contract was in effect.

(3) To register as a trading partner with the Authority, a provider, CCO, PHP, clinic, or allied agency must submit a signed TPA to the Authority.

(4) In addition to the requirements of section (3) of this rule, a trading partner must submit an application for authorization to the Authority. The application provides specific identification and legal authorization from the trading partner for an EDI submitter to conduct EDI transactions on behalf of a trading partner.

(5) A trading partner may use agents to facilitate the electronic transmission of data. If a trading partner will be using an agent as an EDI submitter, the application for authorization required under section (4) of this rule must identify and authorize an EDI submitter and must include the EDI certification signed by an EDI submitter before the Authority may accept electronic submission from or send electronic transmission to an EDI submitter.

(6) In addition to the requirements of section (3) of this rule, a trading partner must also submit its EDI registration form. This form requires the trading partner or its authorized EDI submitter to register an EDI submitter and the name and type of EDI transaction they are prepared to conduct. Signature of the trading partner or authorized EDI submitter is required on the EDI registration form. The registration form will also permit the trading partner to identify the individuals or EDI submitters who are authorized to submit or receive EDI registered transactions.

(7) The Authority shall review the documentation provided to determine compliance with sections (1) through (6) of this rule. The Authority may verify the documentation. When the Authority determines that the information complies with these rules, the Authority shall notify the trading partner and EDI submitter by email about any testing or other requirements applicable to place the registered transaction into a production environment.

History

Statutory/Other Authority: ORS 413.042 & 414.065
Statutes/Other Implemented: ORS 413.042 & 414.065
OHA 7-2012, f. 10-9-12, cert. ef. 10-10-12
OHA 4-2012(Temp), f. & cert. ef. 7-12-12 thru 1-6-13
OHA 26-2011, f. 10-31-11, cert. ef. 11-1-11
OHA 13-2011(Temp), f. & cert. ef. 7-1-11 thru 12-27-11

Or. Admin. R. 943-120-0130 Trading Partner as EDI Submitter — EDI Transactions

(1) A trading partner may be an EDI submitter. Registered trading partners that also qualify as an EDI submitter may submit their own EDI transactions directly to the Authority. A trading partner will be referred to as an EDI submitter when functioning in that capacity and will be required to comply with applicable EDI submitter rules, except as provided in section (3) of this rule.

(2) Authorization and Registration Designating Trading Partner as EDI Submitter. Before acting as an EDI submitter, a trading partner must designate in the application for application that they are an EDI submitter who is authorized to send and receive data transmissions in the performance of EDI transactions. A trading partner must complete the "Trading Partner Application for Authorization to Submit EDI Transactions" and the "EDI Submitter Information" required in the application. A trading partner must also submit the EDI registration form identifying them as an EDI submitter. A trading partner must notify the Authority of any material changes in the information no less than ten days prior to the effective date of the change.

(3) EDI Submitter Certification Conditions. Where a trading partner is acting as its own EDI submitter, the trading partner is not required to submit the EDI submitter certification conditions in the application for authorization applicable to agents.

History

Statutory/Other Authority: ORS 413.042 & 414.065
Statutes/Other Implemented: ORS 413.042 & 414.065
OHA 26-2011, f. 10-31-11, cert. ef. 11-1-11
OHA 13-2011(Temp), f. & cert. ef. 7-1-11 thru 12-27-11

Or. Admin. R. 943-120-0140 Trading Partner Agents as EDI Submitters — EDI Transactions

(1) Responsibility for Agents. If a trading partner uses the services of an agent, including but not limited to an EDI submitter in any capacity in order to receive, transmit, store, or otherwise process data or data transmissions or perform related activities, a trading partner shall be fully responsible to the Authority for the agent's acts.

(2) Notices Regarding EDI Submitter. Prior to the commencement of an EDI submitter's services, a trading partner must designate in the application for authorization the specific EDI submitters that are authorized to send and receive data transmissions in the performance of EDI transactions of a trading partner. A trading partner must complete the "Trading partner Authorization of EDI Submitter" and the "EDI Submitter Information" required in the application. A trading partner must also submit the EDI registration form identifying and providing information about an EDI submitter. A trading partner or authorized EDI submitter must notify the Authority of any material changes in the EDI submitter authorization or information no less than five days prior to the effective date of the changes.

(3) EDI Submitter Authority. A trading partner must authorize the actions that an EDI submitter may take on behalf of a trading partner. The application for authorization permits a trading partner to authorize which decisions may only be made by a trading partner and which decisions are authorized to be made by an EDI submitter. The EDI submitter information authorized in the application for authorization will be recorded by the Authority in an EDI submitter profile. The Authority may reject EDI transactions from an EDI submitter acting without authorization from a trading partner.

(4) EDI Submitter Certification Conditions. Each authorized EDI submitter acting as an agent of a trading partner must execute and comply with the EDI submitter certification conditions that are incorporated into the application for authorization. Failure to include the signed EDI submitter certification conditions with the application shall result in a denial of EDI submitter authorization by the Authority. Failure of an EDI submitter to comply with the EDI submitter certification conditions may result in termination of EDI submitter registration for EDI transactions with the Authority.

(5) EDI Submitters Responsibilities. In addition to the requirements of section (1) of this rule, a trading partner is responsible for ensuring that an EDI submitter makes no unauthorized changes in the data content of all data transmissions or the contents of an envelope, and that an EDI submitter will take all appropriate measures to maintain the timeliness, accuracy, truthfulness, confidentiality, security, and completeness of each data transmission. A trading partner is responsible for ensuring that its EDI submitters are specifically advised of, and will comply with, the terms of these rules and any TPA.

History

Statutory/Other Authority: ORS 413.042 & 414.065
Statutes/Other Implemented: ORS 413.042 & 414.065
OHA 26-2011, f. 10-31-11, cert. ef. 11-1-11
OHA 13-2011(Temp), f. & cert. ef. 7-1-11 thru 12-27-11

Or. Admin. R. 943-120-0150 Testing — EDI Transactions

(1) When a trading partner or authorized EDI submitter registers an EDI transaction with the Authority, the Authority may require testing before authorizing the transaction. Testing may include third party and business-to-business testing. An EDI submitter must be able to demonstrate its capacity to send and receive each transaction type for which it has registered. The Authority will reject any EDI transaction if an EDI submitter either refuses or fails to comply with the Authority testing requirements.

(2) The Authority may require EDI submitters to complete compliance testing at an EDI submitter's expense for each transaction type if either the Authority or an EDI submitter has experienced a change to hardware or software applications by entering into business-to-business testing.

(3) When third party and/or business-to-business testing is completed to the Authority's satisfaction, the Authority will notify an EDI submitter that it will register and accept the transactions in the production environment. This notification authorizes an EDI submitter to submit the registered EDI transactions to the Authority for processing and response, as applicable. If there are any changes in the trading partner or EDI submitter authorization, profile data or EDI registration information on file with the Authority, updated information must be submitted to the Authority as required in OAR 943-120-0190.

(4) Testing will be conducted using secure electronic media communications methods.

(5) An EDI submitter may be required to re-test with the Authority if the Authority format changes or if the EDI submitter format changes.

History

Statutory/Other Authority: ORS 413.042 & 414.065
Statutes/Other Implemented: ORS 413.042 & 414.065
OHA 26-2011, f. 10-31-11, cert. ef. 11-1-11
OHA 13-2011(Temp), f. & cert. ef. 7-1-11 thru 12-27-11

Or. Admin. R. 943-120-0160 Conduct of Transactions — EDI Transactions

(1) EDI Submitter Obligations. An EDI submitter is responsible for the conduct of the EDI transactions registered on behalf of a trading partner, including the following:

(a) EDI Transmission Accuracy. An EDI submitter shall take reasonable care to ensure that data and data transmissions are timely, complete, accurate, and secure; and shall take reasonable precautions to prevent unauthorized access to the information system, the data transmission, or the contents of an envelope which is transmitted either to or from the Authority. The Authority will not correct or modify an incorrect transaction prior to processing. The transaction may be rejected and an EDI submitter notified of the rejection.

(b) Re-transmission of Indecipherable Transmissions. Where there is evidence that a data transmission is lost or indecipherable, the sending party must make best efforts to trace and re-transmit the original data transmission in a manner which allows it to be processed by the receiving party as soon as practicable.

(c) Cost of Equipment. An EDI submitter and the Authority will pay for their own information system costs. An EDI submitter shall, at its own expense, obtain and maintain its own information system. An EDI submitter shall pay its own costs for all charges related to data transmission including, without limitation, charges for information system equipment, software and services, electronic mailbox maintenance, connect time, terminals, connections, telephones, modems, any applicable minimum use charges, and for translating, formatting, sending, and receiving communications over the electronic network to the electronic mailbox, if any, of the Authority. The Authority is not responsible for providing technical assistance in the processing of an EDI transaction.

(d) Back-up Files. EDI submitters must maintain adequate data archives and back-up files or other means sufficient to re-create a data transmission in the event that re-creation becomes necessary for any purpose, within timeframes required by state and federal law, or by contractual agreement. Data archives or back-up files shall be subject to these rules to the same extent as the original data transmission.

(e) Transmissions Format. Except as otherwise provided herein, EDI submitters must send and receive all data transmissions in the federally mandated format, or (if no federal standard has been promulgated) other formats as the Authority designates.

(f) Testing. EDI submitters must, prior to the initial data transmission and throughout the term of a TPA, test and cooperate with the Authority in the testing of information systems as the Authority considers reasonably necessary to ensure the accuracy, timeliness, completeness, and confidentiality of each data transmission.

(2) Security and Confidentiality. To protect security and confidentiality of transmitted data, EDI submitters must comply with the following:

(a) Refrain from copying, reverse engineering, disclosing, publishing, distributing, or altering any data, data transmissions, or the contents of an envelope, except as necessary to comply with the terms of these rules or the TPA, or use the same for any purpose other than that which an EDI submitter was specifically given access and authorization by the Authority or a trading partner;

(b) Refrain from obtaining access by any means to any data, data transmission, envelope, mailbox, or the Authority's information system for any purpose other than that which an EDI submitter has received express authorization. If an EDI submitter receives data or data transmissions from the Authority which clearly are not intended for an EDI submitter, an EDI submitter shall immediately notify the Authority and make arrangements to return or re-transmit the data or data transmission to the Authority. After re-transmission, an EDI submitter shall immediately delete the data contained in the data transmission from its information system;

(c) Install necessary security precautions to ensure the security of the information systems or records relating to the information systems of either the Authority or an EDI submitter when the information system is not in active use by an EDI submitter;

(d) Protect and maintain the confidentiality of security access codes issued by the Authority to an EDI submitter; and

(e) Provide special protection for security and other purposes, where appropriate, by means of authentication, encryption, the use of passwords, or other means. Unless otherwise provided in these rules, the recipient of a protected data transmission must at least use the same level of protection for any subsequent transmission of the original data transmission.

(3) Authority Obligations. The Authority shall:

(a) Make available to an EDI submitter, by electronic media, those types of data and data transmissions which an EDI submitter is authorized to receive.

(b) Inform an EDI submitter of acceptable formats in which data transmissions may be made and provide notification to an EDI submitter within reasonable time periods consistent with HIPAA transaction standards, if applicable, or at least 30 days prior by electronic notice of other changes in formats.

(c) Provide an EDI submitter with security access codes that will allow an EDI submitter access to the Authority's information system. Security access codes are strictly confidential and EDI submitters must comply with all of the requirements of OAR 943-120-0170. The Authority may change the designated security access codes at any time and manner as the Authority, in its sole discretion, deems necessary. The release of security access codes shall be limited to authorized electronic data personnel of an EDI submitter and the Authority with a need to know.

(4) Department of Consumer and Business Services (DCBS) submission standards Health insurers and health care entities in Oregon shall make all necessary actions required by the DCBS Oregon Companion Guides to comply with the Health Insurance Reform Administrative Streamlining and Simplification as specified in OAR 836-100-0100 to 836-100-0120.

History

Statutory/Other Authority: ORS 413.042 & 414.065
Statutes/Other Implemented: ORS 413.042 & 414.065
OHA 26-2011, f. 10-31-11, cert. ef. 11-1-11
OHA 13-2011(Temp), f. & cert. ef. 7-1-11 thru 12-27-11

Or. Admin. R. 943-120-0165 Pharmacy Point of Sale Access

Pharmacy providers who electronically bill pharmaceutical claims must participate in and submit claims using the POS system, except as provided in OAR 410-121-0150.

History

Statutory/Other Authority: ORS 413.042 & 414.065
Statutes/Other Implemented: ORS 413.042 & 414.065
OHA 26-2011, f. 10-31-11, cert. ef. 11-1-11
OHA 13-2011(Temp), f. & cert. ef. 7-1-11 thru 12-27-11

Or. Admin. R. 943-120-0170 Security

(1) Individually Identifiable Health Information. All providers, CCOs, PHPs, and allied agencies are responsible for ensuring the security of individually identifiable health information, consistent with the requirements of the privacy statutes and regulations, and shall take reasonable action to prevent any unauthorized disclosure of confidential information by a provider, CCO, PHP, allied agency, or other agent. A provider, web portal submitter, trading partner, EDI submitter, or other agent must comply with any and all applicable privacy statutes and regulations relating to confidential information.

(2) General Requirements for Electronic Submitters. A provider (web portal submitter), trading partner (EDI submitter), or other agent must maintain adequate security procedures to prevent unauthorized access to data, data transmissions, security access codes, or the Authority's information system, and must immediately notify the Authority of all unauthorized attempts by any individual or entity to obtain access to or otherwise tamper with the data, data transmissions, security access codes, or the Authority's information system.

(3) Notice of Unauthorized Disclosures. All providers, CCOs, PHPs, and allied agencies must promptly notify the Authority of all unlawful or unauthorized disclosures of confidential information that come to its agents' attention pursuant to the Authority’s ISPO policy: http://www.dhs.state.or.us/policy/admin/security/090_005.pdf, and shall cooperate with the Authority if corrective action is required by the Authority. The Authority shall promptly notify a provider, CCO, PHP, or allied agency of all unlawful or unauthorized disclosures of confidential information in relation to a provider, CCO, PHP, or allied agency that come to the Authority's or its agents' attention, and will cooperate with a provider, PHP, or allied agency if corrective action is required.

(4) Wrongful use of the web portal, EDI systems, or the Authority's network and information system, or wrongful use or disclosure of confidential information by a provider, CCO, PHP, allied agency, electronic submitters, or their agents may result in the immediate suspension or revocation of any access granted under these rules or other Authority rules, at the sole discretion of the Authority.

(5) A provider, allied agency, CCO, PHP, or electronic submitter must report to the Authority's Information Security Office at dhsinfo.security@state.or.us and to the Authority program contact individual, any privacy or security incidents that compromise, damage, or cause a loss of protection to confidential information, information assets, or the Authority's network and security system. Reports must be made in the following manner:

(a) No later than five business days from the date on which a provider, allied agency, CCO, PHP, or electronic submitter becomes aware of the incident; and

(b) Provide the results of the incident assessment findings and resolution strategies no later than 30 business days after the report is due under section (4)(a).

(6) A provider, allied agency, CCO, PHP, or electronic submitter must comply with the Authority's requests for corrective action concerning a privacy or security incident and with applicable laws requiring mitigation of harm caused by the unauthorized use or disclosure of confidential information.

History

Statutory/Other Authority: ORS 413.042 & 414.065
Statutes/Other Implemented: ORS 413.042 & 414.065
OHA 7-2012, f. 10-9-12, cert. ef. 10-10-12
OHA 4-2012(Temp), f. & cert. ef. 7-12-12 thru 1-6-13
OHA 26-2011, f. 10-31-11, cert. ef. 11-1-11
OHA 13-2011(Temp), f. & cert. ef. 7-1-11 thru 12-27-11

Or. Admin. R. 943-120-0180 Record Retention and Audit

(1) Records Retention. A provider, CCO, PHP, web portal submitter, trading partner, and EDI submitter shall maintain, for a period of no less than seven years from the date of service, complete, accurate, and unaltered copies of all source documents associated with all data transmissions.

(2) EDI Trade Data Log. An EDI submitter must establish and maintain a trade data log that must record all data transmissions taking place between an EDI submitter and the Authority during the term of a TPA. A trading partner and EDI submitter must take necessary and reasonable steps to ensure that the trade data log constitutes a current, truthful, accurate, complete, and unaltered record of all data transmissions between the parties and must be retained by each party for no less than 24 months following the date of the data transmission. The trade data log may be maintained on electronic media or other suitable means provided that, if necessary, the information may be timely retrieved and presented in readable form.

(3) Right to Audit. A provider, CCO or PHP must allow and require any web portal submitter to allow, and a trading partner must allow and require an EDI submitter or other agent to allow access to the Authority, the Oregon Secretary of State, the Oregon Department of Justice Medicaid Fraud Unit, or its designees, and DHHS or its designees to audit relevant business records, source documents, data, data transmissions, trade data logs, or information systems of a provider and its web portal submitter, and a trading partner, and its agents, as necessary, to ensure compliance with these rules. A provider must allow and require its web portal submitter to allow, and a trading partner must allow and require an EDI submitter or other agent to allow the Authority, or its designee, access to ensure that adequate security precautions have been made and are implemented to prevent unauthorized disclosure of any data, data transmissions, or other information.

History

Statutory/Other Authority: ORS 413.042 & 414.065
Statutes/Other Implemented: ORS 413.042 & 414.065
OHA 7-2012, f. 10-9-12, cert. ef. 10-10-12
OHA 4-2012(Temp), f. & cert. ef. 7-12-12 thru 1-6-13
OHA 26-2011, f. 10-31-11, cert. ef. 11-1-11
OHA 13-2011(Temp), f. & cert. ef. 7-1-11 thru 12-27-11

Or. Admin. R. 943-120-0190 Material Changes

(1) Changes in Any Material Information — EDT Process. A trading partner must submit an updated TPA, application for authorization, or EDI registration form to the Authority within ten business days of any material change in information. A material change includes but is not limited to mailing or email address change, contract number or contract status (termination, expiration, extension), identification of authorized individuals of a trading partner or EDI submitter, the addition or deletion of authorized transactions, or any other change that may affect the accuracy of or authority for an EDI transaction. The Authority may act on data transmissions submitted by a trading partner and its EDI submitter based on information on file in the application for authorization and EDI registration forms until an updated form has been received and approved by the Authority. A trading partner's signature or the signature of an authorized EDI submitter is required to ensure that an updated TPA, authorization, or EDI registration form is valid and authorized.

(2) Changes in Any Material Information — Web Portal Access. Providers must submit an updated web portal registration form to the Authority within ten business days of any material changes in information. A material change includes but is not limited to mailing or email address change, contract number or contract status (termination, suspension, expiration), identification of web portal submitter contact information, or any other change that may affect the accuracy of or authority for a DDE transaction. The Authority is authorized to act on data transmissions submitted by a provider and its web portal submitter based on information on file in the web portal registration form until an updated form has been received and approved by the Authority. A provider's signature or the signature of an authorized business representative is required to ensure that an updated web portal registration form is valid and authorized.

(3) Failure to submit a timely updated form may impact the ability of a data transaction to be processed without errors. Failure to submit a signed, updated form may result in the rejection of a data transmission.

History

Statutory/Other Authority: ORS 413.042 & 414.065
Statutes/Other Implemented: ORS 413.042 & 414.065
OHA 26-2011, f. 10-31-11, cert. ef. 11-1-11
OHA 13-2011(Temp), f. & cert. ef. 7-1-11 thru 12-27-11

Or. Admin. R. 943-120-0200 Authority System Administration

(1) No individual or entity shall be registered to conduct a web portal or an EDI transaction with the Authority except as authorized under these the rules. Eligibility and continued participation as a provider, CCO, PHP, allied agency or web portal submitter in the conduct of DDE transactions, or as a trading partner or EDI submitter in the conduct of registered transactions, is conditioned on the execution and delivery of the documents required in these rules, the continued accuracy of that information consistent with OAR 943-120-0190, and compliance with a requirements of these rules. Data, including confidential information, governed by these rules may be used for purposes related to treatment, payment, and health care operations and for the administration of programs or services by the Authority.

(2) In addition to the requirements of section (1) of this rule, in order to qualify as a trading partner:

(a) An individual or entity must be a Authority provider, CCO, PHP, clinic, or allied agency pursuant to a current valid contract; and

(b) A provider, CCO, PHP, clinic, or allied agency must have submitted an executed TPA and all related documentation, including the application for authorization that identifies and authorizes an EDI submitter.

(3) In addition to the requirements of section (1) of this rule, in order to qualify as an EDI submitter:

(a) A trading partner must have identified the individual or entity as an authorized EDI submitter in the application for authorization;

(b) If a trading partner identifies itself as an EDI submitter, the application for authorization must include the information required in the "Trading Partner Authorization of EDI Submitter" and the "EDI Submitter Information"; and

(c) If a trading partner uses an agent as an EDI submitter, the application for authorization must include the information described in section (3)(b) and the signed EDI submitter certification.

(4) The EDI registration process described in these rules provides the Authority with essential profile information that the Authority may use to confirm that a trading partner or EDI submitter is not otherwise excluded or disqualified from submitting EDI transactions to the Authority.

(5) Nothing in these rules or a TPA prevents the Authority from requesting additional information from a trading partner or an EDI submitter to determine their qualifications or eligibility for registration as a trading partner or EDI submitter.

(6) The Authority shall deny a request for registration as a trading partner or for authorization of an EDI submitter or an EDI registration if it finds any of the following:

(a) A trading partner or EDI submitter has substantially failed to comply with the applicable administrative rules or laws;

(b) A trading partner or EDI submitter has been convicted of (or entered a plea of nolo contendre) a felony or misdemeanor related to a crime or violation of federal or state public assistance laws or privacy statutes or regulations;

(c) A trading partner or EDI submitter is excluded from participation in the Medicare program, as determined by the DHHS secretary; or

(d) A trading partner or EDI submitter fails to meet the qualifications as a trading partner or EDI submitter.

(7) Failure to comply with these rules, trading partner agreement, or EDI submitter certification or failure to provide accurate information on an application or certification may also result in sanctions and payment recovery pursuant to applicable Authority program contracts or rules.

(8) For providers using the DDE submission system by the Authority web portal, failure to comply with the terms of these rules, a web portal registration form, or failure to provide accurate information on the registration form may result in sanctions or payment recovery pursuant to the applicable Authority program contracts or rules.

History

Statutory/Other Authority: ORS 413.042 & 414.065
Statutes/Other Implemented: ORS 413.042 & 414.065
OHA 7-2012, f. 10-9-12, cert. ef. 10-10-12
OHA 4-2012(Temp), f. & cert. ef. 7-12-12 thru 1-6-13
OHA 26-2011, f. 10-31-11, cert. ef. 11-1-11
OHA 13-2011(Temp), f. & cert. ef. 7-1-11 thru 12-27-11

Or. Admin. R. 943-120-0300 Definitions

In addition to the definitions in OAR chapter 410 division 120, the following definitions apply to OAR 943-120-0300 to 943-120-0350:

(1) "Claim" means a bill for services, a line item of a service, or all services for one client within a bill. Claim includes a bill or an encounter associated with requesting reimbursement, whether submitted on paper or electronically. Claim also includes any other methodology for requesting reimbursement that may be established in contract or program-specific rules.

(a) Temporary Assistance to Needy Families (TANF) are categorically eligible families with income levels under current TANF eligibility rules;

(b) CHIP children under one year of age whose household has income under 185% Federal Poverty Level (FPL) and do not meet one of the other eligibility classifications;

(c) Poverty Level Medical (PLM) adults under 100% of the FPL and clients who are pregnant women with income under 100% of FPL;

(d) PLM adults over 100% of the FPL are clients who are pregnant women with income between 100% and 185% of the FPL;

(e) PLM children under one year of age who have family income under 133% of the FPL or were born to mothers who were eligible as PLM adults at the time of the child's birth;

(f) PLM or CHIP children one through five years of age who have family income under 185% of the FPL and do not meet one of the other eligibility classifications;

(g) PLM or CHIP children six through 18 years of age who have family income under 185% of the FPL and do not meet one of the other eligibility classifications;

(h) OHP adults and couples are clients age 19 or over and not Medicare eligible, with income below 100% of the FPL who do not meet one of the other eligibility classifications, and do not have an unborn child or a child under age 19 in the household;

(i) OHP families are clients, age 19 or over and not Medicare eligible, with income below 100% of the FPL who do not meet one of the other eligibility classifications, and have an unborn child or a child under the age of 19 in the household;

(j) General Assistance (GA) recipients are clients who are eligible by virtue of their eligibility under the GA program, ORS 411.710 et seq.;

(k) Assistance to Blind and Disabled (AB/AD) with Medicare eligibles are clients with concurrent Medicare eligibility with income levels under current eligibility rules;

(l) AB/AD without Medicare eligibles are clients without Medicare with income levels under current eligibility rules;

(m) Old Age Assistance (OAA) with Medicare eligibles are clients with concurrent Medicare Part A or Medicare Parts A and B eligibility with income levels under current eligibility rules;

(n) OAA with Medicare Part B only are OAA eligibles with concurrent Medicare Part B only with income under current eligibility rules;

(o) OAA without Medicare eligibles are clients without Medicare with income levels under current eligibility rules; or

(p) Children, Adults and Families (CAF) children are clients with medical eligibility determined by CAF or Oregon Youth Authority (OYA) receiving OHP under ORS 414.025, 418.034, and 418.189 to 418.970. These individuals are generally in placement outside of their homes and in the care or custody of CAF or OYA.

(2) "Covered Services" means medically appropriate health services or items that are funded by the legislature and described in ORS Chapter 414, including OHP authorized under ORS 414.705 to 414.750, and applicable Authority rules describing the benefit packages of covered services except as excluded or limited under OAR 410-141-0500 or other public assistance services provided to eligible clients under program-specific requirements or contracts by providers required to enroll with the Authority under OAR 943-120-0300 to 943-120-0350.

(3) "Medicaid Management Information System (MMIS)" means the automated claims processing and information retrieval system for handling all Medicaid transactions.

(4) "Non-Participating Provider" means a provider who does not have a contractual relationship with the PHP or CCO.

(5) "Prepaid Health Plan (PHP)" means a managed health, dental, chemical dependency, physician care organization, or mental health care organization that contracts with the Division or Addictions and Mental Health Division (AMH) on a case managed, prepaid, capitated basis under the OHP. PHP's may be a Dental Care Organization (DCO), Fully Capitated Health Plan (FCHP), Mental Health Organization (MHO), Primary Care Organization (PCO), or Chemical Dependency Organization (CDO).

(6) "Provider" means an individual, facility, institution, corporate entity, or other organization which supplies health care or other covered services or items, also termed a performing provider, that must be enrolled with the Authority pursuant to OAR 943-120-0300 to 943-120-0350 to seek reimbursement from the Authority, including services provided, under program-specific rules or contracts with the Authority or with a county, PHP, or CCO.

(7) "Quality Improvement" means the effort to improve the level of performance of key processes in health services or health care. A quality improvement program measures the level of current performance of the processes, finds ways to improve the performance and implements new and better methods for the processes. Quality improvement includes the goals of quality assurance, quality control, quality planning, and quality management in health care where "quality of care is the degree to which health services for individuals and populations increase the likelihood of desired health outcomes and are consistent with current professional knowledge."

(8) "Visit Data" means program-specific or contract data collection requirements associated with the delivery of service to clients on the basis of an event such as a visit.

History

Statutory/Other Authority: ORS 413.042
Statutes/Other Implemented: ORS 414.065
OHA 8-2012, f. 10-30-12, cert. ef. 11-1-12
OHA 20-2011, f. 8-30-11, cert. ef. 9-1-11
OHA 14-2011(Temp), f. & cert. ef. 7-1-11 thru 12-27-11

Or. Admin. R. 943-120-0310 Provider Requirements

(1) All providers seeking reimbursement from the Authority, a PHP, CCO, or a county pursuant to a county agreement with the Authority for the provision of covered services or items to eligible recipients, must comply with:

(a) These rules, OAR 943-120-0300 to 943-120-0350: and

(b) The applicable rules or contracts of the specific programs described below:

(A) Programs administered by the Division of Medical Assistance Programs (Division) including the OHP medical assistance program and the CHIP program that reimburse providers for services or items provided to eligible recipients, subject to OAR chapter 410 divisions 120 and 141 and provider rules in chapter 410 applicable to the provider’s service category;

(B) Programs administered by the Addictions and Mental Health Division (AMH) that reimburse providers for services or items provided to eligible AMH recipients (OAR chapters 309 and 415); or

(C) Programs administered by Aging and People with Disabilities (APD) that reimburse providers for services or items provided to eligible APD recipients (OAR chapter 411).

(2) Providers must submit visit data pursuant to program-specific rules or contract. Authority programs use visit data to monitor service delivery, planning, and quality improvement activities. Visit data is not a HIPAA transaction and is not a claim for reimbursement.

[Publications: Publications referenced are available from the agency.]

History

Statutory/Other Authority: ORS 413.042
Statutes/Other Implemented: ORS 414.065, 414.115; 414.125; 414.135; & 414.145
OHA 8-2012, f. 10-30-12, cert. ef. 11-1-12
OHA 20-2011, f. 8-30-11, cert. ef. 9-1-11
OHA 14-2011(Temp), f. & cert. ef. 7-1-11 thru 12-27-11

Or. Admin. R. 943-120-0320 Provider Enrollment

(1) In some Authority program areas, being an enrolled Authority provider is a condition of eligibility for an Authority contract for certain services or activities. Billing providers must be enrolled with the Authority as providers consistent with the provider enrollment processes set forth in OAR 410-120-0310 through 0350 and 410-120-1260. If reimbursement for covered services is made under a contract with the Authority, the provider must also meet the Authority's contract requirements. Contract requirements are separate from the requirements of these rules. Enrollment as a provider with the Authority is not a promise that the enrolled provider shall receive any amount of work from the Authority, a CCO, PHP, or a county.

(2) Provider enrollment establishes essential Authority provider participation requirements for becoming an enrolled Authority provider. The details of provider qualification requirements, client eligibility, covered services, how to obtain prior authorization or review, if required, documentation requirements, claims submission, and available electronic access instructions, and other instructions and requirements are contained in Authority program-specific rules in chapter 410 or contract.

(3) Prior to enrollment, providers must:

(a) Meet all program-specific or contract requirements identified in program-specific rules or contracts and the requirements set forth in these rules and OAR 410-120-1260;

(b) Meet Authority contracting requirements, as specified by the Authority's Office of Contracts and Procurement (OC&P);

(c) Meet Authority and federal licensing and certification requirements for the type of service for which the provider is enrolling; and

(d) Obtain a provider number from the Authority subject to OAR 410-120-1260.

(4) A provider may request to conduct electronic transactions with the Authority by enrolling and completing the appropriate authorization forms pursuant to the electronic data transaction rules (OAR 943-120-0100 to 943-120-0200).

[Publications: Publications referenced are available from the agency.]

History

Statutory/Other Authority: ORS 413.042
Statutes/Other Implemented: ORS 414.065
OHA 8-2012, f. 10-30-12, cert. ef. 11-1-12
OHA 20-2011, f. 8-30-11, cert. ef. 9-1-11
OHA 14-2011(Temp), f. & cert. ef. 7-1-11 thru 12-27-11

Or. Admin. R. 943-120-0330 Billing Procedures

(1) These rules only apply to covered services and items provided to clients that are paid for by the Authority based on an Authority fee schedule or other reimbursement method (often referred to as fee-for-service), or for services that are paid for by the Authority at the request of a county for county-authorized services.

(a) If a client's service or item is paid for by a PHP or CCO, the provider must comply with the billing and procedures related to claim submission established under contract with that PHP, CCO, or the rules applicable to non-participating providers if the provider is not under contract with that PHP or CCO.

(b) If the client is enrolled in a PHP or CCO, but the client is permitted by a contract or program-specific rules to obtain covered services reimbursed by the Authority (such as family planning services that may be obtained from any provider). In addition to this rule, the provider must comply with the billing and claim procedures established in OAR chapter 410 division 120.

(2) All Authority-assigned provider numbers are issued at enrollment and are directly associated with the provider as defined in OAR 410-120-1260 and have the following uses:

(a) Log-on identification for the Authority web portal;

(b) Claim submission in the approved paper formats; and

(c) For electronic claims submission including the web portal for atypical providers pursuant to 45 CFR 160 and 162 where an NPI is not mandated. Use of the Authority-assigned provider number shall be considered the providers authorization and the provider shall be accountable for its use.

(d) Providers may not bill clients or the Authority for services or items provided free of charge. This limitation does not apply to established sliding fee schedules where the client is subject to the same standards as other members of the public or clients of the provider.

(e) Providers shall pay for costs incurred for failing to confirm eligibility or that services are covered.

History

Statutory/Other Authority: ORS 413.042
Statutes/Other Implemented: ORS 414.065
OHA 8-2012, f. 10-30-12, cert. ef. 11-1-12
OHA 20-2011, f. 8-30-11, cert. ef. 9-1-11
OHA 14-2011(Temp), f. & cert. ef. 7-1-11 thru 12-27-11

Or. Admin. R. 943-120-0350 Payments and Overpayments

(1) When an individual’s health care services or item is reimbursed by the Medical Assistance Program, either through a CCO, MCO or the Authority, the provider shall comply with the payment requirements pursuant to OAR chapter 410 or established under contract with that CCO or MCO.

(2) All other covered services and items provided to eligible individuals not part of the Medical Assistance Program shall be:

(a) Within the program-specific contract in effect on the date of service;

(b) Based on program-specific or contract fee schedules or other reimbursement methods; or

(c) For services that are paid for by the Authority, on behalf of a county, authorized by and at the request of a county, provider reimbursement shall include county service authorization information.

(3) The Authority shall pay for services or items for hospitals and ambulatory surgical center services using:

(a) The most recent Medicare payment methodologies established by the Centers for Medicare and Medicaid Services, or similar payment methodologies; or

(b) An alternative payment methodology.

(4) For purposes of this rule, “Alternative payment methodology” means a payment other than a fee-for-services payment, used by health plans as compensation for the provision of integrated and coordinated health care and services. “Alternative payment methodology” includes, but is not limited to:

(a) Shared savings arrangements;

(b) Bundled payments;

(d) Pay for performance; or

(e) Capitation.

(5) The reimbursement methods in these rules are described in greater detail for the Medical Assistance Program in chapter 410 Division 125, the Public Employees’ Benefit Board, chapter 101 and the Oregon Educators Benefits Board, chapter 111 program rules.

History

Statutory/Other Authority: ORS 413.042
Statutes/Other Implemented: ORS 414.065
OHA 1-2016, f. 9-30-16, cert. ef. 10-1-16
OHA 8-2012, f. 10-30-12, cert. ef. 11-1-12
OHA 20-2011, f. 8-30-11, cert. ef. 9-1-11
OHA 14-2011(Temp), f. & cert. ef. 7-1-11 thru 12-27-11

Or. Admin. R. 943-120-1505 Audits and Overpayment Recovery

Providers or contractors receiving payments from or through the Oregon Health Authority are subject to audit or other post payment review procedures for all payments applicable to items or services furnished or supplied by the provider or contractor to or on behalf of the Authority or to its clients.

(1) The Authority adopts and incorporates by reference the rules established in OAR 407-120-1505, for those matters that involve providers or contractors of the Authority, except as otherwise provided in this rule. Audit rules and procedures from OAR 407-120-1505 as incorporated into this rule ensure proper payments were made by the Authority based on requirements applicable to covered services and promote program integrity.

(2) Any reference to OAR 407-120-1505 in rules or contracts of the Authority are deemed to be references to the requirements of this rule, and shall be construed to apply to providers or contractors receiving payments from or through the Authority.

(3) The Authority authorizes the Department to act on its behalf in carrying out audits and establishing overpayment amounts associated with the administration of programs or activities administered by the Authority.

(4) Provider appeals for the Authority shall be handled by the Authority under the procedures set forth in OAR 407-120-1505. References to “the OPAR Administrator” or “the Administrator” are hereby incorporated as references to “the Authority Director.”

[Publication: Publications referenced are available from the agency.]

History

Statutory/Other Authority: ORS 413.042
Statutes/Other Implemented: ORS 411.010, 413.032, 414.065 & 414.715
OHA 21-2011, f. 8-31-11, cert. ef. 9-1-11
OHA 15-2011(Temp), f. & cert. ef. 7-1-11 thru 12-27-11