Or. Rev. Stat. § 431.966 - Disclosure of information

Patient data submitted as part of the prescription monitoring program is considered protected health information and is not subject to disclosure as a public record.  The Oregon Health Authority may disclose prescription monitoring information that identifies a patient, practitioner or drug outlet to the following, if such disclosure complies with HIPAA regulations and other federal and state confidentiality laws:

1. A practitioner or pharmacist involved with the patient’s care who requests the information for purposes of evaluating the need for or providing treatment;
2. A designated representative or any vendor or contractor with whom the authority has contracted to establish or maintain the electronic prescription monitoring program;
3. A health professional regulatory board for purposes of an investigation relating to licensure, renewal or disciplinary action; and
4. A prescription monitoring authority of another state if the confidentiality, security and privacy standards of the requesting state are determined by the authority to be equivalent to those of the authority.

The Oregon Health Authority may disclose information from the prescription monitoring program that does not identify a patient, practitioner or drug outlet to the following:

1. For educational, research or public health purposes; and
2. To officials of the authority who are conducting special epidemiologic morbidity and mortality studies.

Any person authorized to prescribe or dispense a prescription drug who is entitled to access a patient’s prescription monitoring information may discuss or release the information to other providers involved with the patient’s care.  Patients may obtain their prescription monitoring information from the authority at no cost.  Information in the program that identifies an individual patient must be removed no later than three years from the date the information is entered into the program.  The authority will notify the Attorney General and each individual of an improper disclosure of information from the program.