Page 704
704 Chapter 3:Processes and procedures • Section 5: Program integrity (07/2026) • Disclosures made to the individual about their own protected information • Uses or disclosures authorized by the individual that are within the scope of the authorization, or • Disclosures required by law. The minimum necessary standard should be considered at the time the staff member and individual are mutually completing a written Authorization for Use and Disclosure of Individual Information (MSC 3010). ODHS|OHA staff may submit questions regarding ODHS|OHA Privacy Policies and the MSC 3010 authorization form to DHS.PrivacyHelp@dhsoha.state.or.us . This email address can be found in the Outlook address book. The Privacy Program phone number is 503-945-5780. The MSC 2090, Notice of Privacy Practices, describes how medical information about applicants and participants may be used and disclosed and how they can get access to this information. The notice is required to be given at the time of application, and is a required posting in all ODHS|AAA offices. Situations in which a written authorization is not required There are a number of instances in which federal and state law and rule allow information about an individual to be used and disclosed without written authorization and, as necessary, to administer ODHS|OHA programs (including Title XIX). These include the following situations: • When the information is health or treatment information (but not HIV or substance abuse treatment information) and is being released for the purposes of treatment, payment or health care operations (The minimum necessary standard applies to releases for purposes of payment or health care operations.)
Health care operations include such activities as quality assessment and treatment improvement functions, reviewing the competence of health care providers and auditing functions. • When the information being released is non-health information necessary to carry out the intent of an assistance or service program connected with or operated by ODHS|OHA or the designated agency. When the information is non-health information and is being released to an ODHS|OHA contractor in order to administer programs. For example, case managers from ODDS do not need written authorization to ensure financial eligibility and DD service eligibility is in alignment. • When a family member is a relative foster care provider or a homecare worker and information shared relates to care needs. Note: authorization is required to provide any specific information if family member is not care giver. • When the information being released is about a specific individual and is being released to that individual (This exception means participants have access to their own information without signing an authorization.) • When the information is non-health information and is being released to an Oregon attorney who represents that individual if both of the following requirements are met:
The attorney states they are currently representing the individual and
The attorney states the individual has authorized disclosure of the individual’s information to the attorney • When using de-identified information (limited data sets) • When exchanging non-health, non-treatment information with other governmental or private, nonprofit agencies, if necessary to assist applicants or recipients of public assistance to access and receive other