Or. Rev. Stat. § 433.098 - Nonliability for disclosing or using information

Information in an immunization registry regarding a client’s immunization record or tracking and recall record, or information derived from the registry or record, is confidential and may only be disclosed to those who have been specifically authorized to receive such information. Authorized users and his employees or agents will not be liable for using or sharing information from the immunization registry for authorized purposes.

Clients 18 years or older may request that their records be permanently removed from the immunization registry.  The Oregon registry must ensure that another state’s registry has equally strict confidentiality and security policies before sharing data from the registry.