Privacy Law Library

Oregon protected health information law

ORS 192.553-192.581 (PHI)

Health

Oregon's state counterpart to HIPAA declares a right to have protected health information safeguarded and to access it, and sets when health care providers and state health plans may use or disclose it with or without authorization. It works alongside the federal HIPAA Privacy Rule.

Where
Oregon
Citation
ORS 192.553 to 192.581
Status
In force
Enforced by
No specific enforcer named; no new private right of action (ORS 192.571)
People can sue
No
Penalties
No penalties in the act; ORS 192.571 bars a new private right of action under ORS 192.556 or 192.558.
Applies to
  • Health care providers and state health plans in Oregon, for protected health information (ORS 192.556, 192.558)

Rights it gives people

  • Individuals have the right to have PHI safeguarded from unlawful use or disclosure and to access and review it.ORS 192.553(1)

Practices it requires

  • Use or disclose PHI consistent with the individual's authorization, or without authorization only for the provider's or plan's own treatment, payment or operations or as law or court order permits.ORS 192.558(1)-(2)
  • Disclosures to other covered entities or providers without authorization only for their treatment, payment, or limited health care operations where both have a relationship with the patient.ORS 192.558(3)

Sources

Checked against these sources on 2026-09-25 by research agent (Claude), primary sources.

Unverified: Effective date not fetched (formerly ORS 192.518 to 192.524).

Research reference, not legal advice.