Generic Program Elements A. Privacy of Protected Information

DHS home | APD Staff Tools | Generic Program Elements | A. Privacy of Protected Information

Generic Program Elements

A. Privacy of Protected Information

Effective 10/1/07

1. Introduction

All client information is confidential. The Department may not release or disclose client information, except as specifically authorized in administrative rule, law, or as ordered by a court. This means that in responding to questions about a client, staff must not even identify the person as being a client of the department.

The DHS 2090, DHS Notice of Privacy Practices, can be used to inform clients about how DHS may use or disclose their information. The notice is not required to be given to each client but it is a required posting in all DHS/AAA offices.

Obtain a signed authorization from the client if there is any question regarding the release of information. View the request as one of honoring and respecting your client’s choice and dignity, not as an impediment to providing services.

2. Client Consent and Redisclosure of Information

Note: The client, or person to whom he or she has given authorization, must be given access to the client's own case record except as provided in DHS policy AS-100-02, section (4)(d). The term "case record" includes all documents or written information pertaining to a client. Material in closed cases must be made available to the former agency clients within the limits discussed above (411-005-0010). A staff person must be present while the client or authorized third party has access to the case record. Copies can be provided. Use the DHS 2093, Access to Records Request Form.

When and how to obtain consent to release information. A client must sign and date a release of information form (DHS 2099) before a case worker can request information from a third party or release or redisclose information to third parties.

To obtain informed consent, the release form must be understood by the client. Barriers to understanding may include either physical or mental disabilities, or the inability to speak or read English. On the other hand, the presence of a physical or mental disability does not necessarily mean that the person is incapable of giving informed consent.

In most cases, a client indicates informed consent by signing the form with his or her name. For an individual who cannot sign his or her own name, the client can make a mark such as an "X" or request another person to sign on his or her behalf. If a person signs on behalf of the client, the signature should indicate who actually signed, so if client Mary asks Sue to sign on her behalf, it can be recorded as "Mary, by Sue". There is no need to obtain witness of a client signing unless there are other reasons for doing so (e.g. client request, mental competency issue, etc.)

The case worker who needs the information should obtain the signature of the client, or when appropriate, the client’s legal representative, including a guardian or in some circumstances, a conservator.

When approaching a client to obtain consent, it is important to remember that an individual’s ability to give informed consent will depend on a number of factors, including the benefits and risks of a particular decision. Allowing a case worker to talk with a family member about a client’s individual situation would require a different level of informed consent than consenting to a series of cancer treatments, for example. If a person has an established history of non-verbal communication, they may give permission for a case manager to talk with another party about non-intrusive information by giving their usual sign of consent. In such cases, the case manager must document their explanation to the client about what information they intend to give and for what purpose. They must also document the non-verbal method the client used to indicate consent.

Authorization for Use and Disclosure of Information. Staff may request that a client complete a written authorization using the DHS 2099, Authorization for Use and Disclosure . Complete the form with the client whenever possible, making sure that the client understands the form before signing. There should be only one record holder listed per form. The form must include an expiration date/event; and the signature of the individual on the form.

The Authorization for Use and Disclosure is valid for the time period established on the release. The instructions to the DHS 2099 note that the authorization is valid for one year. It is advisable however, to limit their duration to the shortest period of time during which the release or exchange of information may occur.

Provide the release form in the appropriate native language or in an alternate format (braille, large print, etc.) if necessary.

You may conduct business while maintaining client confidentiality. Relevant information may be shared without identifying the specific client. For example, "I am working with a women in her late 80's who was recently diagnosed with terminal cancer. She needs the following type of care. . .". However, if it becomes necessary to identify the client by name or to provide enough specifically identifying information so that the client will become known even if the client’s name is not revealed, obtain the client's permission to disclose the necessary and relevant information.

What if the client refuses to sign the release? An individual may refuse to sign a release of information form. The case worker should continue to talk through with the client what specific objections the client has to the release and why. If that does not resolve the difficulties, the case worker should attempt to serve the client as well as possible with the information available. Also, the case worker should make clear to the client what can or cannot be done without the case worker receiving certain information and assist the client in making an informed choice.

Failure to sign a release cannot be the basis for denying program services to otherwise eligible applicants. However, if the release of information is necessary to obtain documentation related to eligibility for the program, a denial would be based on the lack of required verification necessary to determine program eligibility.

Note: A client has the right to request a restriction on a use or disclosure of information. Use the DHS 2095, Restriction of Use and Disclosures Form. DHS is not obligated to agree to a restriction and may deny the request or may agree to a restriction more limited than what the client requested. Exception: Certain programs can only use information that is authorized by the client, such as alcohol and drug programs or vocational rehabilitation participants.

Redisclosure. Any use or sharing of information obtained under a consent form, or by other means, to anyone else or for any other purpose is a redisclosure.

Information received by the Department which is otherwise confidential or privileged under Oregon law can not be released to a third party without the client providing further written consent.

For example, the Department often obtains copies of an individual’s medical records in connection with an eligibility determination or abuse investigation. These medical records obtained from a third party are exempt from redisclosure unless an additional release is obtained.

Make every reasonable effort not to use, request, or disclose more than the minimum amount of personal information required by law or necessary to accomplish the intended purpose of the use or disclosure.

Client records are subject to redaction prior to access or disclosure. Client records frequently include information pertaining to other individuals, and must be redacted. Redaction should be done by first copying the original record, then blacking out with a permanent marker the information to be withheld, and finally making a copy of the redacted record.

Verification. In every situation in which information is shared inside or outside of DHS, with or without an authorization, staff, volunteers, and contractors are required to take reasonable steps to verify the identity of the person receiving the information, unless the department workforce member fulfilling the request already knows the person or has already verified identity.

3. Determining Whether Client Consent is Necessary

When asked for information regarding a client, there are questions that may be asked in each situation to help determine whether this particular piece of information may be released without a client’s consent.

Are you releasing only the information necessary to carry out the intent of an assistance or service program connected with or operated by the Department or designated agency? Does the information relate to a specific client of public assistance, medical assistance, and federal and state funded programs connected with or operated by the Department or a designated agency? If so, authorization is not required.
Is the requestor asking for general information, policy statements or statistical material which is not identified with any individual or family, and which is therefore not considered confidential? If so, authorization is not required.

A signed release is not necessary to provide client information in the following situations:

Non-health information necessary to administer DHS programs.
To report suspected abuse of a child or an adult (elder abuse, nursing home abuse, or abuse of a person with a mental illness or developmental disability). Note: If necessary, substance abuse treatment information may be disclosed in order to make an initial report of suspected abuse of a child. Substance abuse treatment information may not be disclosed without authorization in order to report suspected abuse of an adult. MH records are not required to be a part of the report for suspected child or adult abuse.
When a client poses clear and present danger to self or to others.
To conduct any investigation, prosecution, or criminal or civil proceeding in connection with administering DHS programs or for any legally authorized audit or review by a governmental entity in relation to administering DHS programs.
In medical emergencies.
To prevent abuse. The information must be necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public and the disclosure is to a person or persons reasonably able to prevent or lessen the threat, including the target of the threat.
To release information to the client.
To release information based on a court order signed by a judge.
For purposes of treatment, payment or health care operations. Health care operations include such activities as quality assessment and treatment improvement functions, reviewing the competence of health care providers and auditing functions.

Click here for a flowchart outlining the exceptions.

If someone is requesting information that does not fall into one of these categories, or if you want to share information that does not fall into one of these categories, authorization is required.

The "Exchanging Information" list (section 6 below), is a list of types of agencies you may contact regarding a client. Examples are provided of the circumstances when authorization may or may not be necessary. This list is intended to be instructive rather than definitive. Each situation should be individually analyzed.

4. Use & Disclosure of Alcohol/Drug and Mental Health Client Information Across DHS Programs

A client has the right to authorize use and disclosure of A&D or MH treatment information to “DHS”, or to a specific program within DHS, such as Self-Sufficiency, or to a specific person (name or title).

A&D and MH treatment information may be disclosed only to the entity (such as DHS), program (such as SPD) or the person (name or title) and only for the specific purpose listed on the DHS 2099.

A client has the right to informed consent when filling out the DHS 2099. Informed consent means the worker has told the client he or she may disclose A&D and MH information to “DHS” as a whole or may limit disclosure to a specific program such as SPD.

In all circumstances, any use or disclosure should be limited to only that information which is reasonably necessary to fulfill the purpose of the request. Exception: For the purposes of mandatory reporting and abuse investigations, A&D treatment information may be disclosed if necessary even if the client has not signed a release authorizing disclosure.

A&D and Mental Health Privacy Law. The clarification above is found in federal A&D law (42 CFR part 2), OAR 410-014-0020 and ORS 179.505.

Some elements of A&D federal law and MH state law regarding use and disclosure of A&D and MH treatment information are stricter than HIPAA. Under HIPAA, the stricter law applies.

Federal law 42 CFR part 2 prohibits unauthorized use, disclosure and redisclosure of A&D treatment information. State law ORS 179.505 prohibits unauthorized use, disclosure and redisclosure of MH information. These laws:

Give a client the right to restrict to what entity or person and for what purpose treatment information may be disclosed.
Require that the client’s right to limit use and disclosure of A&D and MH information be communicated to the client.
Prohibit redisclosure of A&D and MH treatment information without the specific authorization of the client.
Allow a client to authorize use and disclosure of information by filling out and signing a release (such as the DHS 2099) that includes the:
- Name of the person or program making the disclosure.
- Name or title of the individual or the organization to which disclosure is to be made.
- Name of the client.
- Purpose of the disclosure, which must be specific.
- How much and what kind of information is to be disclosed.
Reminder: The purpose of the use and disclosure must be specific to the individual or organization to which the information will be disclosed. If the purpose changes, or is no longer applicable to the individual or organization named on the authorization form to receive the information, the client must complete a new authorization before the information may be disclosed.

Section (3)(b) of DHS Privacy Policy AS-100-03, Use and Disclosure of Client or Participant Information, states that “internal communication within DHS is permitted without individual authorization. . .” with the exception that “alcohol and drug, mental health and vocational rehabilitation record disclosure may be limited to particular program areas named on the authorization form. If such a limitation is noted on the authorization form, disclosure is limited to the parties named.”

Reminder: The client’s right to limit use and disclosure of A&D and MH information must be communicated to the client.

If A&D or MH treatment information is used and disclosed more broadly than the client has authorized on the DHS 2099, the person using the information or making the disclosure may be in violation of federal or state law.

DHS staff may submit questions regarding DHS Privacy Policies and completion of the DHS 2099 authorization form to PrivacyHelp, DHS . This email address can be found in the GroupWise address book or dhs.privacyhelp@state.or.us. The Privacy Program phone number is 503-945-5780.

5. Special Considerations for AIDS/HIV

According to Oregon Revised Statutes 433.045(3), in no instance may a Department employee reveal to any person or agency that a client is HIV positive. (A person who is HIV positive has been exposed to the AIDS virus.) Information on a client's HIV status should usually not be included in the case record unless necessary to determine eligibility. Workers must judge whether a report containing information about HIV is needed to determine eligibility. If not, the information must be destroyed. If HIV information is needed for eligibility determination, the report should be retained, but marked with a notation that the information cannot be released to any person or agency. Do not enter HIV status information into any shared communication system such as Oregon ACCESS.

6. Exchanging Information

When policy permits use or disclosure of an individual’s information to another entity, or when a request is made for an individual’s information from another entity, staff must make reasonable efforts to limit the amount of information to the minimum necessary needed to accomplish the intended purpose of the use, disclosure, or request. For more information on minimum necessary, see DHS Policy AS-100-04 for more information.

DHS and Other State or Federal Agencies

Within DHS
Employment Department
Social Security Administration

Section (3)(b) of DHS Privacy Policy AS-100-03, Use and Disclosure of Client or Participant Information, states that “internal communication within DHS is permitted without individual authorization. . .” with the exception that “alcohol and drug, mental health and vocational rehabilitation record disclosure may be limited to particular program areas named on the authorization form. If such a limitation is noted on the authorization form, disclosure is limited to the parties named.”
No authorization required to share information with other state or federal agencies which administer federally funded programs.
Authorization required if agency requests any information that does not directly relate to the specific agency program in which the client is involved.

Note: Cross program use of physical health, substance abuse, mental health, and vocational rehabilitation information records require written authorization and may be limited to the particular program areas named on the authorization form. If such limitation is noted on the authorization form, disclosure is limited to the programs named, and minimum necessary standards apply.

Medical

Note: Disclosures of protected health information must be recorded in the DHS 2097, Disclosures of Protected Health Information. Disclosures authorized by the client do not have to be tracked.

Hospitals

No authorization required to provide sufficient information to accomplish discharge planning for a client.
No authorization required to provide sufficient information to bill the department for services provided or to explain a delay in payment.
Authorization required to obtain or provide other client-specific information.

Home Health Agencies

No authorization required to provide sufficient information to accomplish a referral on behalf of a client.
Authorization required to obtain or provide other client-specific information.

Mental Health Providers

No authorization required to provide sufficient information to accomplish a referral on behalf of a client.
Authorization required to obtain or provide other client-specific information.

Medical Supply Providers

No authorization required to provide sufficient information to order supplies and equipment.
Authorization required to provide other client- specific information.

Managed Care Plans

No authorization required to provide sufficient information to accomplish a referral on behalf of a client.
Authorization required to obtain or provide other client-specific information.

Physicians, Dentists, Optometrists/Ophthalmologists

No authorization required to provide sufficient information to accomplish a referral on behalf of a client.
Authorization required to obtain or provide other client-specific information.

Financial Services

Social Security Administration
Railroad Benefit Board
Pension and Retirement Plans
Veterans Administration

No authorization required when determining financial eligibility or for the administration of any other federal or federally assisted program which provides assistance in cash, in-kind or services directly to individuals on the basis of need.
No authorization required to report suspected fraud or abuse to SSA.
Authorization required to obtain or provide other client-specific information.

Financial Institutions, i.e. banks, credit unions, etc.

Release required to obtain or provide any client-specific information.

Other Services

Legal Aid or other Legal Services

No authorization required to provide sufficient information to accomplish a referral on behalf of a client.
Authorization required to obtain or provide other client-specific information.

Volunteers

No authorization required to obtain services from DHS volunteers.
Authorization required if volunteer is from a community organization.

Transportation (dial-a-ride)

No authorization required to provide sufficient information to accomplish a referral on behalf of a client.
Authorization required to provide other client-specific information.

Meal Sites

No authorization required to order meals a client has requested.
Authorization required to provide other client-specific.

Senior Centers

No authorization required to request something from a center on behalf of a client.
Authorization required to provide other client-specific information.

Licensed Care Providers and Other Service Providers

No authorization required to provide sufficient information to accomplish a referral on behalf of a client.
Authorization required to provide other client-specific information.

Homecare Workers

No authorization required to provide sufficient information to accomplish a referral on behalf of a client.
Authorization required to provide other client-specific information.

HUD

No authorization required to provide sufficient information (non-health) to accomplish a referral on behalf of a client.
Authorization required to obtain or provide other client-specific information.

Individual Contacts

Family Members

No authorization required if family member is a relative foster provider or a homecare worker and information shared relates to care needs.
Authorization required to provide any client-specific information if family member is not care giver.
If family members are present while talking with client, obtain the client’s agreement or assent to continue confidential conversation with family member present.

Guardians

No authorization required for that subject matter/information over which Guardian has authority. Guardian has same access to client file as client in those areas. Guardian with full powers would have access to entire file. If unclear, ask to see the order of court appointment.

Conservators

No authorization to discuss financial information related to eligibility.
Authorization required to provide non-financial information.

Attorney

Nonhealth information and may be released to an Oregon attorney who represents that client if both of the following requirements are met:
- The attorney states that he or she currently is representing the client.
- The attorney states that the client has authorized disclosure of the client information to the attorney. (461-105-0130(4))
Authorization required to obtain or provide other client-specific information.

Neighbors/Friends; Other Interested Persons

If neighbors or friends are present while talking with client, obtain the client’s agreement or assent to continue confidential conversation with that person present.
Authorization required to provide any client-specific information.

Client access to their own information

Clients have a right to access their records, which include medical and mental health information and reports, subject to certain limitations as outlined in 461-105-0060(6) and in the Client Privacy Rights Policy AS-100-02.
If DHS denies access because of a good faith belief that its disclosure could cause harm to the client or to another person, the decision to deny must be made by a licensed health care professional or other designated staff, and DHS must make a review of this denial available to the client. If the client wishes to have this denial reviewed, the review must be done by a licensed health care professional who was not involved in the original decision.
When a client, or person or entity to which he or she has given written authorization, requests access to their own case record, use the DHS 2093, Access to Records Request Form. A staff person must be present while the client or authorized representative has access to original documents from the case record. Except for HIV information, case record information may be requested by the client and released to the client by telephone if the client is able to satisfy the branch as to their identity.

Other Community Contacts

Law Enforcement

No authorization required when law enforcement are involved in carrying out public assistance laws or investigating proceedings connected with administering the Department’s benefit programs; or when reporting a crime related to abuse.
No authorization is required for a client that is a fugitive felon. This provision allows for the release of address, Social Security number and photo (if available). Law enforcement official must furnish the client's name and tell DHS that the client is a fleeing felon, is violating a condition of probation or parole or has information that is necessary to conduct the officers duties.
Authorization required to provide other client-specific information.

Funeral Homes

No authorization to required to disclose information necessary for the funeral director to carry out their duties.
Authorization required to provide client-specific information.

Insurance Companies

Authorization required to provide client-specific information.

Public Official/State or Federal Legislator

No authorization required when responding to a public official who has received a complaint from a client and agency responding is provided with a copy of the written complaint. Client’s letter is considered a release of information.
Oral authorization required if contacted by public official who has only received an oral complaint. Agency staff will confirm with the client that the agency may speak with the public official regarding the client.

7. Abuse Investigation Reports

A signed release is not necessary to report suspected child or elder abuse.

The identity of the person making the report must be treated as confidential information and shall be disclosed only with the written and informed consent of that person or by court order.

The entire report of an investigation of non-facility elder abuse must be treated as confidential. The report may be disclosed only with the written consent of the victim or by court order. In contrast, a third party request for a facility abuse investigation report that is neither accompanied by appropriate consent from the abuse victim nor in the form of a subpoena should generally be treated as a public records request. The general policy of the law favors public access to government records. However, the identity of complainants and victims should be removed from any reports released.

When reporting back to the complainant in a case, a staff person shall explain only that the investigation has been completed and that appropriate action has been taken. This would be appropriate under most circumstances.

A copy of the completed Adult Foster Home abuse investigation report is sent to the complainant unless they have requested anonymity.

Mental health evaluations conducted during the course of an abuse investigation, even at the direction of DHS, may not be disclosed to DHS without of the consent of the client or a court order.

8. Requirement to Report Abuse

The Department's employees are expected to comply with Oregon Child Abuse Reporting Law (ORS 419B.010-419B.015), the Elderly Abuse Reporting Laws (ORS 124.060 and 124.065), Patient Abuse Reporting Laws (ORS 441.640), and the Abuse Reporting for Mentally Ill and Developmentally Disabled Persons (ORS 430.735-430.765). Speak with your supervisor to determine that appropriate office or agency to call.

Note: Please refer the brochure What You Can Do About Child Abuse (SCF 9061) for more information on reporting child abuse.

After the suspected abuse has been reported to the appropriate agency, case references to suspected abuse should be documented in such a way as to protect the identity of the person reporting the suspected abuse and to prevent compromising any follow-up relating to the suspected abuse.

For more information, see the DHS web page on mandatory reporting.

9. Subpoenas

If you receive a subpoena of any type, do not ignore it under any circumstances.

A subpoena is not a court order. A subpoena is a legal document issued by a court or an attorney that orders a person to appear for testimony. It is a writ or order directed to a person and may require the attendance of that person to testify as a witness or may require that person to produce books, papers, documents, etc. A subpoena duces tecum is a legal document that requires records to be produced.

There are many different kinds of subpoenas; some related to criminal cases, others to civil or administrative matters. Generally, simply reading the document will indicate what type of subpoena it is. While subpoenas may differ slightly, they can be treated in a similar fashion for this purpose. None of the subpoenas can compel release of confidential or privileged information; only a court order can compel such action.

Subpoenas that are accompanied by an appropriate consent should be complied with to the extent authorized by the consent form and permitted by the applicable confidentiality law.

If the subpoena is for a judicial proceeding, a staff member may appear before a judge and advise the court that the subpoena seeks production of confidential and privileged information. If the proceeding is not judicial in nature, the party should contact central office. If necessary, the Attorney General’s office will be contacted or the worker advised to call the AAA Legal Counsel. The rules of evidence and statutes concerning privilege may not be binding in a non-judicial proceeding such as administrative hearings, grand jury proceedings, or depositions. It is recommended that personnel respond to the subpoena by refusing to turn over the information on the basis of the confidentiality statutes.

More more information on the procedures for responding to a subpoena, contact SPD Central Office.

Click here for flowcharts outlining the procedures for various subpoena scenarios.

Policy for Subpoenas. Anytime a worker is served with a subpoena requesting confidential client information, the worker’s supervisor should be notified immediately. Central office may be contacted for technical assistance and to access help from the Department of Justice.

If the worker is served with a subpoena in a judicial proceeding, the worker will appear before the judge and inform the judge that it is the agency’s position that, absent consent of the client, the requested records and testimony about the requested records or the information they contain are privileged and confidential under both federal and state law.

The worker may read the following statement to the judge (choose all that apply):

"Your honor, state and federal law prohibits me from disclosing certain client records and testifying about information contained in those records unless certain conditions are met. Unless the client has provided authorization for release of their information, ORS 410.150 and 411.320 provide that these DHS records are confidential and privileged in any judicial proceeding not directly connected to the administration of public assistance programs, including [insert program name].

o Medicaid: "In addition, Federal law governing these programs (such as, 42 U.S.C. 1396a(a)(7) and regulations (42 CFR 431.300 to 431.307 applicable to Medicaid) require DHS to keep all information related to client benefits under [insert program] confidential."

o APS records: "In addition, DHS abuse investigation records are confidential under ORS 124.085, 124.090, 430.763, 441.650 and 441.671."

Note: If the APS records contain or you have personal knowledge that you will disclose on information listed below, then include the relevant paragraph in your reading of the statement.

o HIV: " Furthermore, if the records contain any HIV information, that information is confidential under ORS 433.045."

o Drug and Alcohol: "Furthermore, if the records contain information pertaining to drug and alcohol treatment information, that information is confidential under 42 CFR Part 2 and 42 CFR 2.64 requires the court to make certain findings before ordering the records to be disclosed."

o Records restricting re-disclosure: " In addition there are records for which I do not have authority to re-disclose to a third party."

o HIPAA: "In addition to these laws, recent federal privacy laws relating to client health information under the Health Insurance Portability and Accountability Act (HIPAA) (45 CFR part 164.512(e)), prohibit the release of a person's protected health information in a judicial proceeding on the basis of a subpoena without the person's authorization for disclosure unless certain procedures are met. These include notification by the person issuing the subpoena to the person whose records are being subpoenaed or entry of a qualified protective order governing the release of the information. Failure to comply with these requirements could result in federal criminal or civil liability. "

Note: if there are other specific federal or state confidentiality statutes that are applicable to the program, please provide that information to the court at this time.

In conclusion, it is the agency's position that compliance with the subpoena at this time would violate both federal and state law. With all due respect, I cannot disclose the requested records or provide testimony concerning the information contained in those records unless the person who is the subject of the records expressly authorizes the disclosure for this purpose, or you order me to do so."

The worker should then follow the direction of the judge.

Discovery subpoenas in court cases are issued by an attorney but do not require the worker to appear before a judge. In these cases, the worker has 14 days (or less if the date for production is earlier) to serve the party issuing the subpoena with written objections to the subpoena. The letter of objection may use the following format:

“Pursuant to ORCP 55B, this letter will serve as the [name of your agency] written objections to the subpoena that you issued in [name of case from subpoena]. [Name of agency] objects to production of these records on the grounds that they are confidential and exempt from disclosure under disclosure order 410.150 and ORS 124.090 and 192.502(8)."

Once the written objections are served, the attorney who issued the subpoena has the burden of going to court to obtain a court order compelling the worker to produce the file. The attorney must give the worker notice of his or her intent to go to court and at that time the worker will follow the instruction for addressing the judge.

10. Address Confidentiality Program

The Department of Justice (DOJ) Address Confidentiality Program (ACP) is a program which provides a mail forwarding service for victims of domestic violence, sexual assault and stalking. The program has limited enrollment due to the stringent requirements.

When approved, each participant will receive an identification card with the ACP P.O. Box which is ACP - P.O. Box 1108, Salem, OR 97308. That address will serve participants across the State. Participants in the program are responsible to present the identification card when requesting a State agency to use the ACP address. The
P.O. Box will be used as the clients’ mailing address.

DOJ will act as the agent of service for any registered mail.
Personal service mail should be delivered to the Department of Justice - 1162
Court Street NE, Salem, OR.

Enter “DO NOT DISCLOSE” in the residential address on CMS, FSMIS and Oregon ACCESS. Resident addresses should be kept in the hard file in an envelope marked confidential. The access should be limited to the worker and manager.

An additional 5 days should be added to 10 day notices per 461-175-0050.

For managed care enrollment, an exception needs to be requested for out-of-area enrollment, due to the Salem address. Send an e-mail to HMU,DMAP with client name, case number, prime numbers for all individuals and the managed care plan the client chose, along with the reason why the exception is needed. DMAP has been made aware of the need for an exception for ACP participants.

11. Forms and References

Forms

DHS 2090, Notice of Privacy Practices
DHS 2092, Notice of Privacy Practices Acknowledgement of Receipt
DHS 2093, Access to Records Request Form
DHS 2094, Amendment of Health Record Request Form
DHS 2095, Restriction of Use and Disclosures Request Form
DHS 2096, Accounting of Disclosures Request Form
DHS 2097, Disclosures of Protected Health Information

References

DHS Policy

AS-100-01, General Privacy
AS-100-02, Client Privacy Rights
AS-100-03, Uses and Disclosures of Client or Participant Information
AS-100-04, Minimum Necessary Information

Oregon Administrative Rules

Chapter 410, 014, Privacy of Protected Information
Chapter 411, Division 005, Confidentiality
Chapter 461, Division 105, General Provisions

Oregon Revised Statutes

179.505, governs the use and disclosure of patient records for persons receiving publicly funded mental health services, alcohol and drug treatment, developmental disability services and public health services.
410.150, Services for Senior and People with Disabilities, Use of files; confidentiality; privileged communications
411.320, Public Assistance, Disclosure and use of public assistance records limited; contents as privileged communication; exceptions
124.050 through 124.095, Elder Abuse
430.735 through 430.765, Mentally or developmentally disabled person abuse
441.460 through 441.680, Nursing facility resident abuse

Federal Law

45 CFR Part 164.522 - 164.528

If you have a disability and need a document on this Web site to be provided to you in another format, please contact the Office of Document Management (ODM) at 503-378-3486 or by e-mail at dhs.forms@state.or.us.

If you have questions about DHS or problems getting DHS services, send e-mail to dhs.info@state.or.us. If you have comments about this site, send e-mail to spd.web@state.or.us.