What is a Patient’s Right to Privacy in Oregon?

Our medical providers have access to a host of sensitive information about us. There is a lot of information that we may not want providers to share with just anyone, and thankfully, there are federal and state laws in place to protect our right to privacy in Oregon. As patients of these providers, we have rights that we can expect to be upheld. When a provider or agency violates our rights to privacy, we may have recourse. Paulson Coletti PC has been involved in the Oregon community, fiercely protecting the rights of injury victims and their families. Our Portland injury lawyers are eager to discuss your case with you.

Understanding Protected Information

We often hear HIPAA thrown around in today’s pop culture or social media spaces. This refers to the Health Insurance Portability and Accountability Act (HIPAA) established in 1996. HIPAA sets the standard for a patient’s right to privacy as we know it today. Many people assume this refers to someone’s personal health information in all contexts. However, this specifically targets how a healthcare provider can share your personal health information (PHI). This means that your primary care provider must maintain confidentiality, but your neighbor does not. The term PHI includes identifiable information such as:

• Contact numbers
• Patient name
• E-mail address
• Service or discharge date
• Social Security number
• Birth date
• Insurance policy number
• Address

Designated Record Set

The ‘designated record set’ is included in HIPAA privacy protections. This term refers to a group of records kept by or for a covered entity that may include documents used for billing purposes, enrollment or claims, or medical records used to make decisions with and for the patient regarding treatment.

How Your Protected Information May be Used

Oregon privacy laws require your providers to maintain the confidentiality of your health information in most circumstances. This means they may not share your information with anyone outside covered entities as defined in 192.556. According to ORS 192.558, Oregon healthcare providers may disclose your information in some situations, such as:

• A person indicated on a signed Release of Information
• A covered entity, such as a health insurance provider
• Other physicians in the same covered entity for reasons of collaborating to provide care
• Someone else is present, and you do not object to them sharing the information
• As otherwise permitted by federal law or court order

Sometimes, your information may be shared if the provider determines it may be in your best interest. This is generally for situations in which you are incapacitated. However, these should be shared with the minimum necessary standard in mind. This standard is true, even in circumstances of other medical consults.

Minimum Necessary Standard

The minimum necessary standard is the goal of sharing the minimum information necessary to achieve the goal. This practice minimizes the personal information shared, reducing the opportunity for misuse. There are several circumstances where the minimum necessary standard is not observed, including:

• Disclosures to or requests by a healthcare provider for treatment purposes
• Disclosures to the person about whom the information is
• Uses or disclosures made in accordance with the individual’s authorization
• Uses or disclosures as otherwise required to comply with HIPAA
• Disclosures or usages the law otherwise requires

An example of how the minimum necessary standard protects your information may be a practice with multiple physicians. Only the treating physician should have access to your chart and medical information unless necessary for a consult. If another physician is required to collaborate for your treatment, they should only discuss relevant information about your current condition.

Release of Information

The release of your information outside of covered entities may generally only be done with the appropriate release of information. This authorization to use and disclose health information must include specific information. The required information includes:

• Patient name
• Date of birth
• Entity information may be shared with
• Types of information
• The expiration date for the authorization
• Signature of the patient or their representative

A patient has the right to withdraw the release of information in writing at any time before the designated expiration date. If they do not withdraw their consent, the release immediately becomes void at the expiration date. If the provider or agency shares information beyond this date, they are considered to be in violation of privacy laws.

Oregon Penalties for Privacy Law Violation

The penalties for HIPAA violations can be severe. The HIPAA journal states that civil penalties can range from just over $100 to nearly $69,000 per violation. The fines assigned are generally correlated with the severity and malice of the situation. For example, someone who accidentally disclosed information will likely see less severe consequences than someone who intentionally shared information for personal or monetary gain.

Ongoing or intentional violations of privacy laws, either federal or state, can leave a provider vulnerable to professional consequences. These consequences can apply to an individual or agency. An individual provider may see their license suspended or revoked. An agency may lose accreditations as well as funding through certain insurance providers.

In addition to civil fines by governing agencies, providers who violate privacy laws are also vulnerable to personal injury or medical malpractice lawsuits. The HIPAA journal states that there is not ground for a lawsuit based specifically on HIPAA violations, but there may be routes to recovering monetary damages through other types of lawsuits.

Recovering From Privacy Violations

It can feel like a significant violation to learn that your information has been mishandled or negligently protected. This can be especially true if private information has been carelessly shared with other people in your life who you may have wished not to know. If you have suffered harm due to the careless actions of care providers, you may benefit from speaking with an attorney to determine the best option for justice. If you choose not to pursue a civil lawsuit, you may still feel driven to ensure the offending parties are held accountable. Taking formal action through legal routes or by simply filing a complaint with the medical board or other governing agencies can help you find justice as well as protect others from similar violations.