(a) "Covered entity" means:

(A) The Children’s Health Insurance Program;

(B) A health insurer that is an insurer as defined in ORS 731.106 and that issues health insurance as defined in ORS 731.162;

(C) The state medical assistance program; and

(D) A health care provider.

(b) "Health care provider" includes but is not limited to:

(A) A psychologist, occupational therapist, regulated social worker, professional counselor or marriage and family therapist licensed or otherwise authorized to practice under ORS chapter 675 or an employee of the psychologist, occupational therapist, regulated social worker, professional counselor or marriage and family therapist;

(B) A physician or physician assistant licensed under ORS chapter 677, an acupuncturist licensed under ORS 677.759 or an employee of the physician, physician assistant or acupuncturist;

(C) A nurse or nursing home administrator licensed under ORS chapter 678 or an employee of the nurse or nursing home administrator;

(D) A dentist licensed under ORS chapter 679 or an employee of the dentist;

(E) A dental hygienist or denturist licensed under ORS chapter 680 or an employee of the dental hygienist or denturist;

(F) A speech-language pathologist or audiologist licensed under ORS chapter 681 or an employee of the speech-language pathologist or audiologist;

(G) An emergency medical services provider licensed under ORS chapter 682;

(H) An optometrist licensed under ORS chapter 683 or an employee of the optometrist;

(I) A chiropractic physician licensed under ORS chapter 684 or an employee of the chiropractic physician;

(J) A naturopathic physician licensed under ORS chapter 685 or an employee of the naturopathic physician;

(K) A massage therapist licensed under ORS 687.011 to 687.250 or an employee of the massage therapist;

(L) A direct entry midwife licensed under ORS 687.405 to 687.495 or an employee of the direct entry midwife;

(M) A physical therapist licensed under ORS 688.010 to 688.201 or an employee of the physical therapist;

(N) A medical imaging licensee under ORS 688.405 to 688.605 or an employee of the medical imaging licensee;

(O) A respiratory care practitioner licensed under ORS 688.815 or an employee of the respiratory care practitioner;

(P) A polysomnographic technologist licensed under ORS 688.819 or an employee of the polysomnographic technologist;

(Q) A pharmacist licensed under ORS chapter 689 or an employee of the pharmacist;

(R) A dietitian licensed under ORS 691.405 to 691.485 or an employee of the dietitian;

(S) A funeral service practitioner licensed under ORS chapter 692 or an employee of the funeral service practitioner;

(T) A health care facility as defined in ORS 442.015;

(U) A home health agency as defined in ORS 443.014;

(V) A hospice program as defined in ORS 443.850;

(W) A clinical laboratory as defined in ORS 438.010;

(X) A pharmacy as defined in ORS 689.005; and

(Y) Any other person or entity that furnishes, bills for or is paid for health care in the normal course of business.

(c) "Individual" means a natural person.

(d) "Individually identifiable health information" means any oral or written health information in any form or medium that is:

(A) Created or received by a covered entity, an employer or a health care provider that is not a covered entity; and

(B) Identifiable to an individual, including demographic information that identifies the individual, or for which there is a reasonable basis to believe the information can be used to identify an individual, and that relates to:

(i) The past, present or future physical or mental health or condition of an individual;

(ii) The provision of health care to an individual; or

(iii) The past, present or future payment for the provision of health care to an individual.

(e) "Legal representative" means attorney at law, person holding a general power of attorney, guardian, conservator or any person appointed by a court to manage the personal or financial affairs of a person, or agency legally responsible for the welfare or support of a person.

(2)(a) During a public health emergency declared under ORS 433.441, the Public Health Director may, as necessary to appropriately respond to the public health emergency:

(A) Adopt reporting requirements for and provide notice of those requirements to health care providers, institutions and facilities for the purpose of obtaining information directly related to the public health emergency;

(B) After consultation with appropriate medical experts, create and require the use of diagnostic and treatment protocols to respond to the public health emergency and provide notice of those protocols to health care providers, institutions and facilities;

(C) Order, or authorize local public health administrators to order, public health measures appropriate to the public health threat presented;

(D) Authorize pharmacists licensed under ORS chapter 689 to administer vaccines to persons who are three years of age or older;

(E) Upon approval of the Governor, take other actions necessary to address the public health emergency and provide notice of those actions to health care providers, institutions and facilities, including public health actions authorized by ORS 431A.015;

(F) Take any enforcement action authorized by ORS 431A.010, including the imposition of civil penalties of up to $500 per day against individuals, institutions or facilities that knowingly fail to comply with requirements resulting from actions taken in accordance with the powers granted to the Public Health Director under subparagraphs (A), (B) and (E) of this paragraph; and

(G) The authority granted to the Public Health Director under this section:

(i) Supersedes any authority granted to a local public health authority if the local public health authority acts in a manner inconsistent with guidelines established or rules adopted by the director under this section; and

(ii) Does not supersede the general authority granted to a local public health authority or a local public health administrator except as authorized by law or necessary to respond to a public health emergency.

(b) The authority of the Public Health Director to take administrative action, and the effectiveness of any action taken, under paragraph (a)(A), (B) and (D) to (G) of this subsection terminates upon the expiration of the declared state of public health emergency, unless the actions are continued under other applicable law.

(3) Civil penalties under subsection (2) of this section shall be imposed in the manner provided in ORS 183.745. The Public Health Director must establish that the individual, institution or facility subject to the civil penalty had actual notice of the action taken that is the basis for the penalty. The maximum aggregate total for penalties that may be imposed against an individual, institution or facility under subsection (2) of this section is $500 for each day of violation, regardless of the number of violations of subsection (2) of this section that occurred on each day of violation.

(4)(a) During a declared state of public health emergency, the Public Health Director and local public health administrators shall be given immediate access to individually identifiable health information necessary to:

(A) Determine the causes of an illness related to the public health emergency;

(B) Identify persons at risk;

(C) Identify patterns of transmission;

(D) Provide treatment; and

(E) Take steps to control the disease.

(b) Individually identifiable health information accessed as provided by paragraph (a) of this subsection may not be used for conducting nonemergency epidemiologic research or to identify persons at risk for post-traumatic mental health problems, or for any other purpose except the purposes listed in paragraph (a) of this subsection.

(c) Individually identifiable health information obtained by the Public Health Director or local public health administrators under this subsection may not be disclosed without written authorization of the identified individual except:

(A) Directly to the individual who is the subject of the information or to the legal representative of that individual;

(B) To state, local or federal agencies authorized to receive such information by state or federal law;

(C) To identify or to determine the cause or manner of death of a deceased individual; or

(D) Directly to a health care provider for the evaluation or treatment of a condition that is the subject of a declaration of a state of public health emergency issued under ORS 433.441.

(d) Upon expiration of the state of public health emergency, the Public Health Director or local public health administrators may not use or disclose any individually identifiable health information that has been obtained under this section. If a state of emergency that is related to the state of public health emergency has been declared under ORS 401.165, the Public Health Director and local public health administrators may continue to use any individually identifiable information obtained as provided under this section until termination of the state of emergency.

(5) All civil penalties recovered under this section shall be paid into the State Treasury and credited to the General Fund and are available for general governmental expenses.

(6) The Public Health Director may request assistance in enforcing orders issued pursuant to this section from state or local law enforcement authorities. If so requested by the Public Health Director, state and local law enforcement authorities, to the extent resources are available, shall assist in enforcing orders issued pursuant to this section.

(7) If the Oregon Health Authority adopts temporary rules to implement the provisions of this section, the rules adopted are not subject to the provisions of ORS 183.335 (6)(a). The authority may amend temporary rules adopted pursuant to this subsection as often as necessary to respond to the public health emergency. [2003 c.555 §§2,3; 2007 c.445 §24; 2009 c.442 §40; 2009 c.595 §674; 2009 c.833 §34; 2011 c.703 §39; 2011 c.715 §18; 2013 c.129 §28; 2013 c.332 §4; 2013 c.681 §52; 2017 c.206 §14]