Or. Rev. Stat. § 192.558 - Health care provider and state health plan authority

A health care provider or state health plan may use or disclose protected health information as authorized by the patient or the patient’s personal representative.  A provider or plan may use or disclose protected health information without obtaining an authorization for the following purposes:

• The information is for use in the provider or plan’s own treatment, payment, or health care operations;
• The disclosure is to another covered entity that has/had a relationship with the patient, if the information pertains to that relationship and the disclosure is for purposes of the entity’s health care operations or fraud and abuse detection or compliance;
• The disclosure is to any covered entity or other health care provider for treatment activities or for payment activities of the receiving entity;
• The disclosure or use is otherwise permitted or required by law or court order.