2021 Oregon Revised Statutes
Chapter 433 - Disease and Condition Control; Mass Gatherings; Indoor Air
Section 433.008 - Confidentiality of disclosure; exceptions; privilege.

(b) Except as required for the administration or enforcement of public health laws or rules, a state or local public health official or employee may not be examined in an administrative or judicial proceeding about the existence or contents of a reportable disease report or other information received by the authority or local public health administrator in the course of an investigation of a reportable disease or disease outbreak.
(2) The authority or a local public health administrator may release information obtained during an investigation of a reportable disease or disease outbreak to:
(a) State, local or federal agencies authorized to receive the information under state or federal law;
(b) Health care providers if necessary for the evaluation or treatment of a reportable disease;
(c) Law enforcement officials to the extent necessary to carry out the authority granted to the Public Health Director and local public health administrators under ORS 433.121, 433.128, 433.131, 433.138 and 433.142;
(d) A person who may have been exposed to a communicable disease;
(e) A person with information necessary to assist the authority or local public health administrator in identifying an individual who may have been exposed to a communicable disease; and
(f) The individual who is the subject of the information or the legal representative of that individual.
(3) The authority or local public health administrator may release individually identifiable information under subsection (2)(d) or (e) of this section only if there is clear and convincing evidence that the release is necessary to avoid an immediate danger to other individuals or to the public.
(4) The authority or local public health administrator may release only the minimum amount of information necessary to carry out the purpose of the release pursuant to subsection (2) of this section.
(5) A decision not to disclose information under this subsection, if made in good faith, shall not subject the entity or person withholding the information to any liability.
(6) Nothing in this section:
(a) Prevents the authority or a local public health administrator from publishing statistical compilations and reports relating to reportable disease investigations if the compilations and reports do not identify individual cases or sources of information;
(b) Affects the confidentiality or admissibility into evidence of information not otherwise confidential or privileged that is obtained from sources other than the authority; or
(c) Prevents dispositions of information pursuant to ORS 192.105. [1987 c.600 §5; 2009 c.268 §3; 2009 c.828 §18; 2021 c.92 §§2,3]
Note: The amendments to 433.008 by section 3, chapter 92, Oregon Laws 2021, become operative June 30, 2022. See section 4, chapter 92, Oregon Laws 2021. The text that is operative until June 30, 2022, including amendments by section 2, chapter 92, Oregon Laws 2021, is set forth for the user’s convenience. (1)(a) Except as provided in subsection (2) of this section and section 1, chapter 92, Oregon Laws 2021, information obtained by the Oregon Health Authority or a local public health administrator in the course of an investigation of a reportable disease or disease outbreak is confidential and is exempt from disclosure under ORS 192.311 to 192.478.
(b) Except as required for the administration or enforcement of public health laws or rules, a state or local public health official or employee may not be examined in an administrative or judicial proceeding about the existence or contents of a reportable disease report or other information received by the authority or local public health administrator in the course of an investigation of a reportable disease or disease outbreak.
(2) The authority or a local public health administrator may release information obtained during an investigation of a reportable disease or disease outbreak to:
(a) State, local or federal agencies authorized to receive the information under state or federal law;
(b) Health care providers if necessary for the evaluation or treatment of a reportable disease;
(c) Law enforcement officials to the extent necessary to carry out the authority granted to the Public Health Director and local public health administrators under ORS 433.121, 433.128, 433.131, 433.138 and 433.142;
(d) A person who may have been exposed to a communicable disease;
(e) A person with information necessary to assist the authority or local public health administrator in identifying an individual who may have been exposed to a communicable disease; and
(f) The individual who is the subject of the information or the legal representative of that individual.
(3) The authority or local public health administrator may release individually identifiable information under subsection (2)(d) or (e) of this section only if there is clear and convincing evidence that the release is necessary to avoid an immediate danger to other individuals or to the public.
(4) The authority or local public health administrator may release only the minimum amount of information necessary to carry out the purpose of the release pursuant to subsection (2) of this section.
(5) A decision not to disclose information under this subsection, if made in good faith, shall not subject the entity or person withholding the information to any liability.
(6) Nothing in this section:
(a) Prevents the authority or a local public health administrator from publishing statistical compilations and reports relating to reportable disease investigations if the compilations and reports do not identify individual cases or sources of information;
(b) Affects the confidentiality or admissibility into evidence of information not otherwise confidential or privileged that is obtained from sources other than the authority; or
(c) Prevents dispositions of information pursuant to ORS 192.105.
Note: Sections 1 and 4 (1), chapter 92, Oregon Laws 2021, provide:
Sec. 1. Disclosure of individually identifiable information related to COVID-19; rules. (1) As used in this section:
(a) "COVID-19" means a disease caused by the severe acute respiratory syndrome coronavirus 2 (SARS-CoV-2).
(b) "Health care provider" means:
(A) An individual licensed or certified by the:
(i) State Board of Examiners for Speech-Language Pathology and Audiology;
(ii) State Board of Chiropractic Examiners;
(iii) State Board of Licensed Social Workers;
(iv) Oregon Board of Licensed Professional Counselors and Therapists;
(v) Oregon Board of Dentistry;
(vi) State Board of Massage Therapists;
(vii) Oregon Board of Naturopathic Medicine;
(viii) Oregon State Board of Nursing;
(ix) Oregon Board of Optometry;
(x) State Board of Pharmacy;
(xi) Oregon Medical Board;
(xii) Occupational Therapy Licensing Board;
(xiii) Oregon Board of Physical Therapy;
(xiv) Oregon Board of Psychology; or
(xv) Board of Medical Imaging;
(B) An emergency medical services provider licensed by the Oregon Health Authority under ORS 682.216;
(C) A clinical laboratory licensed under ORS 438.110; and
(D) A health care facility as defined in ORS 442.015.
(2) The Oregon Health Authority may disclose individually identifiable information related to COVID-19 that is reportable under ORS 433.004 and rules adopted by the authority if the authority determines that the disclosure is necessary for the evaluation, treatment or care coordination of individuals who have been tested for COVID-19 or individuals who have had a substantial exposure to COVID-19, or is necessary for the state’s COVID-19 response and recovery efforts, to:
(a) An American Indian tribe or an agency of an American Indian tribe;
(b) A health care provider;
(c) An entity providing care coordination services; or
(d) An entity that administers or operates a health information technology system that is used by a person listed in this subsection.
(3) The authority may disclose only the minimum amount of information necessary to carry out the purpose of a disclosure under subsection (2) of this section.
(4) A person listed in subsection (2) of this section may submit a request in writing to the authority requesting COVID-19 information. The authority may require the requester to describe the purposes for which the requester will use the information.
(5) The authority may enter into agreements that condition disclosure of information under subsection (2) of this section on the recipient of the disclosure agreeing to:
(a) Use the information for purposes consistent with the state’s COVID-19 response and recovery efforts.
(b) Provide information to the authority regarding the evaluation, treatment or care coordination provided to individuals with COVID-19 or to individuals with a substantial exposure to COVID-19.
(c) Provide information to the authority regarding whether and how the disclosure assisted the recipient of the disclosure in providing care coordination services or was necessary for response and recovery efforts.
(d) Enter into a data use agreement that, at a minimum, describes how the data may be used and whether it can be redisclosed.
(e) Report any breaches of confidentiality.
(6) Information obtained under subsection (2) of this section that identifies an individual with COVID-19 or an individual with a substantial exposure to COVID-19, or that contains information that reasonably could lead to the identification of such an individual, is confidential and exempt from disclosure under ORS 192.311 to 192.478.
(7) The authority may adopt rules necessary for the administration of this section. [2019 c.92 §1]
Sec. 4. Sunset. (1) Section 1 of this 2021 Act is repealed on June 30, 2022.
[2021 c.92 §4(1)]

Structure 2021 Oregon Revised Statutes