(a) Is with the written authorization of the individual, and:

(A) If the authorization is submitted by another licensee or insurance-support organization, the authorization meets the requirements of ORS 746.630; or

(B) If the authorization is submitted by a person other than a licensee or insurance-support organization, the authorization is:

(i) Dated;

(ii) Signed by the individual; and

(iii) Obtained one year or less prior to the date a disclosure is sought pursuant to this subsection.

(b) Is to a person other than a licensee or insurance-support organization, if the disclosure is reasonably necessary to enable the person to:

(A) Perform a business, professional or insurance function for the disclosing licensee or insurance-support organization and the person agrees not to disclose the information further without the individual’s written authorization unless the further disclosure:

(i) Would otherwise be permitted by this section if made by a licensee or insurance-support organization; or

(ii) Is reasonably necessary for the person to perform its function for the disclosing licensee or insurance-support organization; or

(B) Provide information to the disclosing licensee or insurance-support organization for the purpose of:

(i) Determining an individual’s eligibility for an insurance benefit or payment; or

(ii) Detecting or preventing criminal activity, fraud, material misrepresentation or material nondisclosure in connection with an insurance transaction.

(c) Is to a licensee, insurance-support organization or self-insurer, if the information disclosed is limited to that which is reasonably necessary:

(A) To detect or prevent criminal activity, fraud, material misrepresentation or material nondisclosure in connection with insurance transactions; or

(B) For either the disclosing or receiving licensee or insurance-support organization to perform its function in connection with an insurance transaction involving the individual.

(d) Is to a health care provider and discloses only such information as is reasonably necessary to accomplish one or more of the following purposes:

(A) Verifying insurance coverage or benefits.

(B) Informing an individual of a medical problem of which the individual may not be aware.

(C) Conducting an operations or services audit.

(e) Is to an insurance regulatory authority.

(f) Is to a law enforcement or other governmental authority:

(A) To protect the interests of the licensee or insurance-support organization in preventing or prosecuting the perpetration of fraud upon it; or

(B) If the licensee or insurance-support organization reasonably believes that illegal activities have been conducted by the individual.

(g) Is otherwise permitted or required by law.

(h) Is in response to a facially valid administrative or judicial order, including a search warrant or subpoena.

(i) Is made for the purpose of conducting actuarial or research studies, if:

(A) No individual may be identified in any resulting actuarial or research report;

(B) Materials allowing the individual to be identified are returned or destroyed as soon as they are no longer needed; and

(C) The actuarial or research organization agrees not to disclose the information unless the disclosure would otherwise be permitted by this section if made by a licensee or insurance-support organization.

(j) Is to a party or a representative of a party to a proposed or consummated sale, transfer, merger or consolidation of all or part of the business of the licensee or insurance-support organization, if:

(A) Prior to the consummation of the sale, transfer, merger or consolidation only such information is disclosed as is reasonably necessary to enable the recipient to make business decisions about the purchase, transfer, merger or consolidation; and

(B) The recipient agrees not to disclose the information unless the disclosure would otherwise be permitted by this section if made by a licensee or insurance-support organization.

(k) Is to a nonaffiliated third party whose only use of the information will be in connection with the marketing of a product or service, if all of the following conditions are met:

(A) No privileged information or personal information is disclosed, and no classification derived from such information may be disclosed.

(B) The individual must have been given the notice described in ORS 746.620 and an opportunity to indicate that the individual does not want personal information disclosed for marketing purposes and must have given no indication that the individual does not want the information disclosed. The individual need not have been given the opportunity described in this subparagraph if the disclosure is made pursuant to a joint marketing agreement. As used in this subparagraph, "joint marketing agreement" means a formal written contract pursuant to which an insurer jointly offers, endorses or sponsors a financial product or service with a financial institution. When the opportunity is required, the statement that offers the opportunity must state that the insurer may disclose personal information to nonaffiliates and that the individual has a right to indicate that the individual does not want personal information disclosed for marketing purposes, and must describe the method for exercising that right. The statement must be in writing but may be in an electronic form if the individual agrees. The individual who is given the opportunity must be provided a reasonable time to exercise the opportunity. An individual may exercise the opportunity at any time. A statement by an individual barring disclosure of personal information remains effective until the individual who made the statement revokes the statement in writing or, if the individual agrees, in electronic form.

(C) The person receiving the information must agree not to use it except in connection with the marketing of a product or service.

(L) Is to an affiliate whose only use of the information will be in connection with an audit of the licensee or the marketing of a financial product or service, and the affiliate agrees not to disclose the information for any other purpose or to unaffiliated persons. This paragraph does not apply to the disclosure of individually identifiable health information for the purpose of marketing a financial product or service.

(m) Is by a consumer reporting agency, and the disclosure is to a person other than a licensee.

(n) Is to a group policyholder for the purpose of reporting claims experience or conducting an audit of the licensee’s operations or services, and the information disclosed is reasonably necessary for the group policyholder to conduct the review or audit.

(o) Is to a professional peer review organization for the purpose of reviewing the service or conduct of a health care provider.

(p) Is to a governmental authority for the purpose of determining the individual’s eligibility for health benefits for which the governmental authority may be liable.

(q) Is to a policyholder or certificate holder for the purpose of providing information regarding the status of an insurance transaction.

(2) Personal or privileged information may be acquired by a group practice prepayment health care service contractor from providers which contract with the contractor and may be transferred among providers which contract with the contractor for the purpose of administering plans offered by the contractor. The information may not be disclosed otherwise by the contractor except in accordance with ORS 746.600 to 746.690. [1981 c.649 §15; 1987 c.490 §53; 2001 c.377 §28; 2003 c.87 §14]