OAR 943-014-0305
Definitions

For purpose of these rules, the following terms have definitions set forth below. All other terms not defined in this section shall have the meaning used in the Health Insurance Portability and Accountability Act (HIPAA) security rules found at 45 CFR § 164.304:

(1)

“Access” means the ability or the means necessary to read, communicate, or otherwise use any Authority information asset.

(2)

“Access Control Process” means Authority forms and processes used to authorize a user, identify their job assignment, and determine the required access.

(3)

“Authority” means the Oregon Health Authority.

(4)

“Client Records” means any client, applicant, or participant information regardless of the media or source, provided by the Authority to the user, or exchanged between the Authority and the user.

(5)

“Incident” means the attempted or successful unauthorized access, use, disclosure, modification, or destruction of any network and information system or Authority information asset including, but not limited to unauthorized disclosure of information; failure to protect user’s identification (ID) provided by the Authority; or, theft of computer equipment that uses or stores any Authority information asset.

(6)

“Information Asset” means any information, also known as data, provided through the Authority, regardless of the source or media, which requires measures for security and privacy of the information.

(7)

“Network and Information System” means the State of Oregon’s computer infrastructure, which provides personal communications, client records and other sensitive information assets, regional, wide area and local area networks, and the internetworking of various types of networks on behalf of the Authority.

(8)

“User” means any individual authorized by the Authority to access a network and information system or information asset.

(9)

“Organization” means any entity authorized by the Authority to access a network and information system or information asset.

Source: Rule 943-014-0305 — Definitions, https://secure.sos.state.or.us/oard/view.action?ruleNumber=943-014-0305.

943–014–0000
Definitions 943–014–0010
Purpose 943–014–0015
Covered Entity Status for Purposes of the HIPAA Privacy Rules 943–014–0020
Uses and Disclosures of Client or Participant Protected Information 943–014–0030
Client Privacy Rights 943–014–0040
Minimum Necessary Standards 943–014–0060
Uses and Disclosures of Protected Information for Research Purposes 943–014–0070
De-identification of Client Information and Use of Limited Data Sets under Data Use Agreements 943–014–0200
Confidentiality and Inadmissibility of Mediation Communications 943–014–0205
Confidentiality and Inadmissibility of Workplace Interpersonal Dispute Mediation Communications 943–014–0300
Scope 943–014–0305
Definitions 943–014–0310
Information Access 943–014–0315
Security Information Assets 943–014–0320
User Responsibility 943–014–0400
Purpose 943–014–0410
Definitions 943–014–0415
General Business Associate Requirements 943–014–0420
Uses and Disclosures of Protected Health Information by Business Associate 943–014–0430
Authority Obligations 943–014–0435
Contractor Security Requirements 943–014–0440
Breach 943–014–0445
Violations 943–014–0450
Termination of Contract 943–014–0455
Order of Precedence 943–014–0460
Authority Compliance Methods 943–014–0465
Standards in Individual Contracts

California:	Codes
Colorado:	C.R.S.
Nevada:	NRS
New York:	Laws
Oregon:	OAR, ORS
Texas:	Statutes
World:	Rome Statute, International Dictionary

OAR 943-014-0305 Definitions

(1)

(2)

(3)

(4)

(5)

(6)

(7)

(8)

(9)

OAR 943-014-0305
Definitions