OAR 943-014-0070
De-identification of Client Information and Use of Limited Data Sets under Data Use Agreements

(1)

The Authority may use and disclose information as appropriate for the work of the Authority, without further restriction, if the Authority or another entity has taken steps to de-identify the information pursuant to 45 CFR part 164.514(a) and (b).

(2)

The Authority may assign a code or other means of record identification to allow the Authority to re-identify the de-identified information provided that:

(a)

The code or other means of record identification is not derived from or related to information about the individual and cannot otherwise be translated to identify the individual; and

(b)

The Authority does not use or disclose the code or other means of record identification for any other purpose, and does not disclose the mechanism for re-identification.

(3)

The Authority may use and disclose a limited data set if the Authority enters into a data use agreement with an entity requesting or providing the Authority with a limited data set subject to the requirements of 45 CFR part 164.514(e).

(a)

The Authority may use and disclose a limited data set only for the purposes of research, public health, or health care operations. The Authority may use limited data set for its own activities or operations if the Authority has obtained a limited data set that is subject to a data use agreement.

(b)

If the Authority knows of a pattern of activity or practice of a limited data set recipient that constitutes a material breach or violation of a data use agreement, the Authority shall take reasonable steps to cure the breach or end the violation. If such steps are unsuccessful, the Authority shall discontinue disclosure of information to the recipient and report the problem to the Secretary of DHHS.

Source: Rule 943-014-0070 — De-identification of Client Information and Use of Limited Data Sets under Data Use Agreements, https://secure.sos.state.or.us/oard/view.action?ruleNumber=943-014-0070.

943‑014‑0000
Definitions 943‑014‑0010
Purpose 943‑014‑0015
Covered Entity Status for Purposes of the HIPAA Privacy Rules 943‑014‑0020
Uses and Disclosures of Client or Participant Protected Information 943‑014‑0030
Client Privacy Rights 943‑014‑0040
Minimum Necessary Standards 943‑014‑0060
Uses and Disclosures of Protected Information for Research Purposes 943‑014‑0070
De-identification of Client Information and Use of Limited Data Sets under Data Use Agreements 943‑014‑0200
Confidentiality and Inadmissibility of Mediation Communications 943‑014‑0205
Confidentiality and Inadmissibility of Workplace Interpersonal Dispute Mediation Communications 943‑014‑0300
Scope 943‑014‑0305
Definitions 943‑014‑0310
Information Access 943‑014‑0315
Security Information Assets 943‑014‑0320
User Responsibility 943‑014‑0400
Purpose 943‑014‑0410
Definitions 943‑014‑0415
General Business Associate Requirements 943‑014‑0420
Uses and Disclosures of Protected Health Information by Business Associate 943‑014‑0430
Authority Obligations 943‑014‑0435
Contractor Security Requirements 943‑014‑0440
Breach 943‑014‑0445
Violations 943‑014‑0450
Termination of Contract 943‑014‑0455
Order of Precedence 943‑014‑0460
Authority Compliance Methods 943‑014‑0465
Standards in Individual Contracts

California:	Codes
Colorado:	C.R.S.
Nevada:	NRS
New York:	Laws
Oregon:	OAR, ORS
Texas:	Statutes
World:	Rome Statute, International Dictionary

OAR 943-014-0070 De-identification of Client Information and Use of Limited Data Sets under Data Use Agreements

(1)

(2)

(a)

(b)

(3)

(a)

(b)

OAR 943-014-0070
De-identification of Client Information and Use of Limited Data Sets under Data Use Agreements