Oregon has a robust medical assistance program that provides a number of health care delivery and payment options to qualifying individuals.  As part of this program, the state has enacted a number of laws governing the collection, use and disclosure of protected information from individuals participating in Medicaid, CHIP and related waiver programs.  As a baseline condition of participation in the program, all Medicaid providers must maintain confidential clinical records for all patients receiving services, including information on the patient’s diagnosis and medical need for services, and must maintain such records for seven years.1  Clients in the medical assistance program have the right to access their own records, unless otherwise restricted by law.2

        The Department of Human Services must obtain a completed and signed authorization for release of information from the client before obtaining, using or disclosing protected health information about the individual from or to a third party.  The Department or other authorized persons may use or disclose protected health information about  a client without his permission for certain purposes, including for treatment, payment and health care operations and to the extent necessary to provide emergency treatment.3

Certain programs and providers have different requirements that govern the collection, use and disclosure of protected information about clients.  The primary care manager providing care management services to an Oregon Health Plan client must maintain clinical records on each client for four years after the date of medical services and may only release the records to the extent permitted by the provider agreement.4

The law mandates reporting specific to the medical assistance program.  Pharmacies must report when dispensing a controlled substance to a fee-for-service client, including the patient’s name, address, and date of birth, the drug information and the prescriber’s information.5  All insurers providing coverage to Medicaid beneficiaries must report health care data for use in evaluating the demands for and allocation of healthcare resources.6