The Oregon Administrative Rules contain OARs filed through November 15, 2015

 

QUESTIONS ABOUT THE CONTENT OR MEANING OF THIS AGENCY'S RULES?
CLICK HERE TO ACCESS RULES COORDINATOR CONTACT INFORMATION

 



OREGON HEALTH AUTHORITY, HEALTH POLICY AND ANALYTICS




 

DIVISION 25

ALL-PAYER HEALTHCARE CLAIMS DATA REPORTING PROGRAM
409-025-0100
Definitions
The following definitions apply
to OAR 409-025-0100 to 409-025-0170:
(1) “Accident policy”
means an insurance policy that provides benefits only for a loss due to accidental
bodily injury.
(2) “Administrator”
means the administrator of the Office for Oregon Health Policy and Research.
(3) “Allowed amount”
means the actual amount of charges for healthcare services, equipment, or supplies
that are covered expenses under the terms of an insurance policy or health benefits
plan.
(4) “Association”
means any organization, including a labor union, that has an active existence for
at least one year, that has a constitution and bylaws and that has been organized
and is maintained in good faith primarily for purposes other than that of obtaining
insurance.
(5) “Attending provider”
means the individual health care provider who delivered the health care services,
equipment, or supplies specified on a health care claim.
(6) “Authority”
means the Oregon Health Authority.
(7) “Billing provider”
means the individual or entity that submits claims for health care services, equipment,
or supplies delivered by an attending provider.
(8) “Capitated services”
means services rendered by a provider through a contract in which payments are based
upon a fixed dollar amount for each enrolled member on a monthly basis.
(9) “Carrier” shall
have the meaning given that term in ORS 743.730(6).
(10) “Certificate of authority” shall have the
meaning given that term in ORS 731.072.
(11) “Charges” means the actual
dollar amount charged on the claim.
(12) “Claim” means
an encounter or request for payment under the terms of an insurance policy, health
benefits plan, Medicare, or Medicaid.
(13) "Co-insurance" means the
percentage an enrolled member pays toward the cost of a covered service.
(14) “Coordinated Care
Organization (CCO)” shall have the meaning given that term in ORS 414.025(5).
(15) "Co-payment" means the
fixed dollar amount an enrolled member pays to a health care provider at the time
a covered service is provided or the full cost of a service when that is less than
the fixed dollar amount.
(16) “Current Procedural
Terminology(CPT)” means a medical code set of physician and other services,
maintained and copyrighted by the American Medical Association, and adopted by the
U.S. Secretary of Health and Human Services as the standard for reporting physician
and other services on standard transactions.
(17) “Data set”
means a collection of individual data records, whether in electronic or manual files.
(18) “DCBS” means
the Oregon Department of Consumer and Business Services.
(19) “Deductible”
means the total dollar amount an enrolled member pays toward the cost of covered
services over an established period of time before the carrier or third-party administrator
makes any payments under an insurance policy or health benefit plan.
(20) “De-identified health
information” means health information that does not identify an individual
and with respect to which there is no reasonable basis to believe that the information
can be used to identify an individual.
(21) “Direct personal
identifier” means information relating to an individual patient or enrolled
member that contains primary or obvious identifiers, including:
(a) Names;
(b) Business names when that
name would serve to identify a person;
(c) Postal address information
other than town or city, state, and 5-digit zip code;
(d) Specific latitude and longitude
or other geographic information that would be used to derive postal address;
(e) Telephone and fax numbers;
(f) Electronic mail addresses;
(g) Social security numbers;
(h) Vehicle identifiers and
serial numbers, including license plate numbers;
(i) Medical record numbers;
(j) Health plan beneficiary
numbers;
(k) Certificate and license
numbers;
(l) Internet protocol (IP) addresses
and uniform resource locators (URL) that identify a business that would serve to
identify a person;
(m) Biometric identifiers, including
finger and voice prints; and
(n) Personal photographic images.
(22) “Director’s
Office” means the Director’s Office of the Oregon Health Authority.
(23) “Disability policy”
means an insurance policy that provides benefits for losses due to a covered illness
or disability.
(24) “Disclosure”
means the release, transfer, provision of access to, or divulging in any other manner
of information outside the entity holding the information.
(25) “Dual Eligible Special
Needs Plan” means a Special Needs Plan that enrolls beneficiaries entitled
to both Medicare and Medicaid.
(26) “Eligibility file”
means a data set containing demographic information for each individual enrolled
member eligible for medical benefits for one or more days of coverage at any time
during a calendar month for an Oregon resident as defined in ORS 803.355, a non-Oregon
resident who is a member of a PEBB or OEBB group health insurance plan, or services
provided in Oregon.
(27) “Eligible employee”
shall have the meaning given that term in ORS 743.730(12).
(28) “Employee”
shall have the meaning given that term in ORS 654.005(4).
(29) “Employer”
shall have the meaning given that term in ORS 654.005(5).
(30) “Encrypted identifier”
means a code or other means of identification to allow individual patients or enrolled
members to be tracked across data sets without revealing their identity.
(31) "Encryption" means a method
by which the true value of data has been disguised in order to prevent the identification
of individual patients or enrolled members and does not provide the means for recovering
the true value of the data.
(32) “Enrolled member”
means enrollee as defined in ORS 743.730(14).
(33) “Facility”
means a health care facility as defined in ORS 442.015(16).
(34) “Genetic tests”
shall have the meaning given that term in ORS 192.531(14).
(35) “Group health insurance”
shall have the meaning given that term in ORS 743.522.
(36) “Health benefit plan”
shall have the meaning given that term in ORS 743.730(19).
(37) “Health care”
shall have the meaning given that term in ORS 192.519(3).
(38) “Health care provider”
shall have the meaning given that term in ORS 192.519(5).
(39) “Health information”
shall have the meaning given that term in ORS 192.519(6).
(40) “Healthcare claims
data file” means electronic health information including medical claims files,
medical eligibility files, pharmacy claims files, pharmacy eligibility files, and
any other related information specified in this rule.
(41) “Healthcare Common
Procedure Coding System(HCPCS)” means a medical code set, maintained by the
United States Department of Health and Human Services, that identifies health care
procedures, equipment, and supplies for claim submission purposes.
(42) “HIPAA” means
Title II, Subtitle F of the Health Insurance Portability and Accountability Act
of 1996, 42 USC 1320d, et seq. and the federal regulations adopted to implement
the Act.
(43) “Hospital indemnity
policy” means an insurance policy that provides benefits only for covered
hospital stays.
(44) “Indirect personal
identifier” means information relating to an individual patient or enrolled
member that a person with appropriate knowledge of and experience with generally
accepted statistical and scientific principles and methods could apply to render
such information individually identifiable by using such information alone or in
combination with other reasonably available information.
(45) “Individual”,
when used in a list of required lines of business, means individual health benefit
plans.
(46) “Individually identifiable
health information” shall have the meaning given that term in ORS 192.519(8).
(47) “Insurance”
shall have the meaning given that term in ORS 731.102.
(48) “Labor union”
means any organization which is constituted for the purpose, in whole or in part,
of collective bargaining or dealing with employers concerning grievances, terms
or conditions of employment or of other mutual aid or protection in connection with
employees.
(49) “Large group”
means health benefit plans for employers with more than 50 employees.
(50) “Limited data set”
means protected health information that excludes direct personal identifiers and
is disclosed for research, program operations, or to a public health authority for
public health purposes.
(51) “Long-term care insurance”
shall have the meaning given that term in ORS 743.652(4).
(52) “Managed care organization”(MCO)
means a prepaid managed care health services organization as defined in ORS 414.736.
(53) “Mandatory reporter” means any reporting
entity defined as a mandatory reporter in OAR 409-025-0110.
(54) “Medicaid” means medical
assistance provided under 42 U.S.C. section 1396a(section 1902 of the Social Security
Act), as administered by the Division of Medical Assistance Programs.
(55) “Medicaid fee-for-service”(Medicaid
FFS) means that portion of Medicaid where a health care provider is paid a fee for
each covered health care service delivered to an eligible Medicaid patient.
(56) “Medical claims file”
means a data set composed of health care service level remittance information for
all adjudicated claims for each billed service including but not limited to member
demographics, provider information, charge and payment information, and clinical
diagnosis and procedure codes for an Oregon resident as defined in ORS 803.355,
a non-Oregon resident who is a member of a PEBB or OEBB group health insurance plan,
or services provided in Oregon.
(57) “Medical provider
file” means a data set containing information about health care providers
providing health care services, equipment, or supplies to enrolled members during
the reporting period.
(58) “Medicare”
means coverage under Part A, Part B, Part C, or Part D of Title XVIII of the Social
Security Act, 42 U.S.C. 1395 et seq., as amended.
(59) “Medicare Modernization
Act” means the Medicare Prescription Drug, Improvement, and Modernization
Act of 2003(Public Law 108-173) and the federal regulations adopted to implement
the Act.
(60) “OEBB” means
the Oregon Educators Benefit Board.
(61) “OHPR” means
the Office for Oregon Health Policy and Research.
(62) “OMIP” means
the Oregon Medical Insurance Pool.
(63) “Patient” means
any person in the data set who is the subject of the activities of the claim performed
by the health care provider.
(64) “Paid amount”
means the actual dollar amount paid for claims.
(65) “PEBB” means
the Oregon Public Employees’ Benefit Board.
(66) “Person” shall
have the meaning given that term in ORS 731.116.
(67) “Pharmacy benefit
manager(PBM)” means a person or entity that performs pharmacy benefit management,
including a person or entity in a contractual or employment relationship with a
person or entity performing pharmacy benefit management for a health benefits plan.
(68) “Pharmacy claims
file” means a data set containing service level remittance information from
all adjudicated claims including, but not limited to, enrolled member demographics,
provider information, charge and payment information, and national drug codes for
an Oregon resident as defined in ORS 803.355, a non-Oregon resident who is a member
of a PEBB or OEBB group health insurance plan, or services provided in Oregon.
(69) “Pharmacy eligibility
file” means a data set containing demographic information for each individual
enrolled member eligible for pharmacy benefits for one or more days of coverage
at any time during a calendar month for an Oregon resident as defined in ORS 803.355,
a non-Oregon resident who is a member of a PEBB or OEBB group health insurance plan,
or services provided in Oregon.
(70) “Policy” shall
have the meaning given that term in ORS 731.122.
(71) “Portability”
means portability health benefit plans as defined in ORS 743.760.
(72) "Prepaid amount" means
the fee for the service equivalent that would have been paid for a specific service
if the service had not been capitated.
(73) “Premium” shall
have the meaning given that term in ORS 743.730.
(74) “Principal investigator
(PI)” means the person in charge of a research project that makes use of limited
data sets. The PI is the custodian of the data and shall comply with all state and
federal restrictions, limitations, and conditions of use associated with the data
release.
(75) “Protected health
information” shall have the meaning given that term in ORS 192.519(11).
(76) “Public health authority”
means the Public Health Division of the Authority or local public health authority
as defined in ORS 431.260(7).
(77) “Public health purposes”
means the activities of a public health authority for the purpose of preventing
or controlling disease, injury, or disability including, but not limited to, the
reporting of disease, injury, vital events such as birth or death, and the conduct
of public health surveillance, investigations, and interventions.
(78) “Public use data
set” means a publicly available data set of de-identified health information
containing only the data elements specified by OHPR for inclusion.
(79) “Registered entity”
means any person required to register with DCBS under ORS 744.714.
(80) “Reporting entity”
means:
(a) An insurer as defined in
ORS 731.106 or fraternal benefit society as defined in ORS 748.106 required to have
a certificate of authority to transact health insurance business in Oregon.
(b) A health care service contractor
as defined in ORS 750.005 that issues medical insurance in Oregon.
(c) A third-party administrator
required to obtain a license under ORS 744.702.
(d) A pharmacy benefit manager
or fiscal intermediary, or other person that is by statute, contract, or agreement
legally responsible for payment of a claim for a health care item or service.
(e) A prepaid managed care health
services organization as defined in ORS 414.736.
(f) An insurer providing coverage
funded under Part A, Part B, or Part D of Title XVIII of the Social Security Act,
subject to approval by the United States Department of Health and Human Services.
(81) “Research”
means a systematic investigation, including research development, testing and evaluation,
designed to develop or contribute to generalized knowledge.
(82) “Self-insured plan”
means any plan, program, contract, or any other arrangement under which one or more
employers, unions, or other organizations provide health care services or benefits
to their employees or members in this state, either directly or indirectly through
a trust or third-party administrator.
(83) “Small employer health
insurance” means health benefit plans for employers whose workforce consists
of at least two but not more than 50 eligible employees.
(84) “Special Needs Plan”
means a Medicare health benefit plan created by the Medicare Modernization Act that
is specifically designed to provide targeted care to individuals with special needs.
(85) “Specific disease
policy” means an insurance policy that provides benefits only for a loss due
to a covered disease.
(86) “Strongly-encrypted”
means an encryption method that uses a cryptographic key with a large number of
random keyboard characters.
(87) “Subscriber”
means the individual responsible for payment of premiums or whose employment is
the basis for eligibility for membership in a health benefit plan.
(88) “Third-party administrator
(TPA)” means any person who directly or indirectly solicits or effects coverage
of, underwrites, collects charges or premiums from, or adjusts or settles claims
on, residents of Oregon or residents of another state from offices in Oregon, in
connection with life insurance or health insurance coverage; or any person or entity
who must otherwise be licensed under ORS 744.702.
(89) “Transact insurance”
shall have the meaning given that term in ORS 731.146.
(90) “Trust” means
a fund established by:
(a) Two or more employers in
the same or related industry; or
(b) One or more labor unions;
or
(c) One or more employers and
one or more labor unions; or
(d) An association as described
in ORS 743.522(1)(b).
(91) “Vision policy”
means a health benefits plan covering only vision health care.
(92) “Voluntary reporter” means any registered
or reporting entity, other than a mandatory reporter, that voluntarily elects to
comply with the reporting requirements in OAR 409-025-0100 to 409-025-0170.
Stat. Auth.: ORS 442.466

Stats. Implemented: ORS 442.464
& 442.466

Hist.: OHP 1-2010, f. 2-26-10,
cert. ef. 3-1-10; OHP 4-2012, f. 5-23-12, cert. ef. 6-1-12; OHP 5-2012(Temp), f.
6-23-12, cert. ef. 6-1-12 thru 11-15-12; OHP 6-2012; f. 6-26-12, cert. ef. 7-9-12
409-025-0110
General Reporting Requirements
(1) Definition of “mandatory
reporter”
(a) For carriers and licensed
third-party administrators, OHPR shall identify mandatory reporters using information
collected by DCBS including, but not limited to, data from the Health Insurance
Member Enrollment Report.
(A) OHPR shall aggregate the
most recent four quarters of data.
(B) OHPR shall calculate the
mean total lives for each carrier and licensed third-party administrator.
(C) All carriers and licensed
third-party administrators with calculated mean total lives of 5,000 or higher shall
be mandatory reporters.
(b) All PBMs shall be mandatory
reporters.
(c) All MCOs shall be mandatory
reporters.
(d) All CCOs shall be mandatory
reporters.
(e) All reporting entities with
Dual Eligible Special Needs Plans in Oregon shall be mandatory reporters.
(2) Voluntary reporters may
elect to participate by notifying the Administrator in writing.
(3) Mandatory and voluntary
reporters shall submit healthcare claims data files for all required lines of business
and shall not submit claims for any excluded lines of business. Required and excluded
lines of business are specified in Schedule B.
(4) Mandatory and voluntary
reporters shall comply with healthcare claims data file layout, format, and coding
requirements in OAR 409-025-0120.
(5) Mandatory and voluntary
reporters shall comply with healthcare claims data submission requirements in OAR
409-025-0130.
(6) Unless otherwise required
by state or federal rules, regulations or statutes, mandatory and voluntary reporters
shall not submit the following types of claims:
(a) Claims related to genetic
tests; or
(b) Any claims subject to stricter
disclosure limits imposed by state or federal rules, regulations, or statutes.
(7) OHPR shall provide written
notification to all mandatory reporters subject to the reporting requirements of
OAR 409-025-0100 to 409-025-0170.
(a) Beginning March 1, 2010
OHPR shall notify all mandatory reporters subject to the reporting requirements
of OAR 409-025-0100 to 409-025-0170 during the calendar year 2010.
(b) By July 1, 2010 OHPR shall
notify all mandatory reporters subject to the reporting requirements of OAR 409-025-0100
to 409-025-0170 for the calendar year 2011.
(c) Beginning January 1, 2011,
OHPR shall notify by July 1 all mandatory reporters subject to the reporting requirements
of OAR 409-025-0100 to 409-025-0170 for the following calendar year.
Stat. Auth.: ORS 442.466

Stats. Implemented: ORS 442.464
& 442.466

Hist.: OHP 1-2010, f. 2-26-10,
cert. ef. 3-1-10; OHP 4-2012, f. 5-23-12, cert. ef. 6-1-12; OHP 5-2012(Temp), f.
6-23-12, cert. ef. 6-1-12 thru 11-15-12; OHP 6-2012; f. 6-26-12, cert. ef. 7-9-12
409-025-0120
Healthcare Claims Data
File Layout, Format, and Coding Requirements
(1) Required healthcare claims
data files shall include:
(a) Medical claims;
(b) Eligibility;
(c) Medical provider;
(d) Pharmacy claims; and
(e) Control totals.
(2) The medical claims file
shall be submitted using the approved layout, format, and coding described in Appendix
A.
(3) The eligibility file shall
be submitted using the approved layout, format, and coding described in Appendix
B.
(4) The medical provider file
shall be submitted using the approved layout, format, and coding described in Appendix
C.
(5) The pharmacy claims file
shall be submitted using the approved layout, format, and coding described in Appendix
D.
(6) The control totals file
shall be submitted using the approved layout, format, and coding described in Appendix
E.
(7) All data elements are required
unless specified as optional or situational.
(8) All required healthcare
claims data files shall be submitted as delimited ASCII files.
(9) Numeric data are positive
integers unless otherwise specified.
(a) Negative values are allowed
for revenue codes, quantities, charges, payment, co-payment, co-insurance, deductible,
and prepaid amount.
(b) Negative values shall be
preceded by a minus sign.
(10) OHPR shall convene a technical
advisory group to advise OHPR and associated contractors on submission specifications
including but not limited to Appendices A-E, Schedule A and any additional data
submission requirements. The advisory group shall include, but not be limited to
representatives from:
(a) Carriers;
(b) TPAs;
(c) PBMs;
(d) CCOs; and
(e) Other stakeholders and interested
parties.
(11) All data files shall pass
edit checks and validations implemented by OHPR or the data vendor.
Stat. Auth.: ORS 442.466

Stats. Implemented: ORS 442.464
& 442.466

Hist.: OHP 1-2010, f. 2-26-10,
cert. ef. 3-1-10; OHP 4-2012, f. 5-23-12, cert. ef. 6-1-12
409-025-0130
Healthcare Claims Data
Submission Requirements
(1) OHPR shall notify mandatory
reporters of the submission start date for program initiation in 2010, which shall
occur when the following conditions are met:
(a) Final versions of Appendices
A-C have been published on the OHPR web site for at least 120 days; and
(b) OHPR is satisfied that the
data vendor is prepared to test transmission of healthcare claims data files from
mandatory reporters.
(2) Mandatory reporters shall
submit healthcare claims data files as specified in Schedule A. Voluntary reporters
may consult with OHPR to submit healthcare claims data files on an alternative schedule.
(3) Mandatory and voluntary
reporters shall submit healthcare claims data files directly to the data vendor
unless otherwise specified by OHPR.
(4) Mandatory and voluntary
reporters shall transmit healthcare claims data files using one of the following
approved processes:
(a) Secure file transfer protocol
(SFTP) including separate strong encryption of data files prior to SFTP transmission;
or
(b) Any process incorporating
strong encryption that is approved in writing by both OHPR and the data vendor.
Stat. Auth.: ORS 442.466

Stats. Implemented: ORS 442.464
& 442.466

Hist.: OHP 1-2010, f. 2-26-10,
cert. ef. 3-1-10; OHP 4-2012, f. 5-23-12, cert. ef. 6-1-12
409-025-0140
Waivers and Exceptions
(1) OHPR may grant a waiver of the reporting requirements.
(a) A mandatory reporter requesting a waiver of the reporting requirements shall submit a Waiver of Reporting Requirements Form (APAC-1) to OHPR. The request must be received by OHPR 60 calendar days prior to the applicable reporting deadline.
(A) OHPR shall approve a request for a waiver from a mandatory reporter when the mandatory reporter is already subject to substantially similar claims data reporting requirements under a contract with the Authority. The waiver shall remain in force so long as the mandatory reporter is in compliance with its claims data reporting requirements under its contract with the Authority. A waiver approved under this section shall automatically expire as of the date the mandatory reporter is no longer required to submit substantially similar claims data under its contract with the Authority.
(B) A mandatory reporter’s lines of business that are not under a contract with the Authority shall not be covered by a waiver approved under OAR-409-025-0140(1)(a)(A).
(C) If OHPR does not approve a request for a waiver from a mandatory reporter the written notification from OHPR shall include the reason(s) for the denial.
(b) OHPR shall approve or deny the request and provide written notification to the requester within 30 calendar days of receipt of the request.
(c) If OHPR denies the waiver, the requester may appeal the denial by requesting a contested case hearing. The appeal must be filed within 30 business days of the denial. The appeal process is conducted pursuant to ORS chapter 183 and the Attorney General’s Uniform and Model rules of Procedure for the Office of Administrative Hearings, OAR 137-003-0501 to 137-003-0700. The requester shall have the burden to prove a compelling need for the waiver.
(d) The waiver shall expire at the end of the calendar year unless otherwise specified by OHPR.
(2) OHPR may grant an exception to healthcare claims data file layout, format, and coding requirements, and submission requirements:
(a) A mandatory reporter requesting an exception for healthcare claims data file layout, format, or coding requirements shall submit a Healthcare Claims Data File Format Exception Form (APAC-2) to OHPR. The request must be received by OHPR prior to the applicable reporting deadline.
(b) The mandatory reporter requesting an exception to healthcare claims data submission requirements shall submit a Healthcare Claims Data File Submission Requirement Exception Form (APAC-3) to OHPR. The request must be received by OHPR prior to the applicable reporting deadline.
(c) OHPR shall approve or deny the request and provide written notification to the requester within 30 calendar days of receipt of the request.
(d) If OHPR denies the waiver, the requester may appeal the denial by requesting a contested case hearing. The appeal must be filed within 30 business days of the denial. The appeal process is conducted pursuant to ORS chapter 183 and the Attorney General’s Uniform and Model rules of Procedure for the Office of Administrative Hearings, OAR 137-003-0501 to 137-003-0700. The requester shall have the burden to prove a compelling need for the waiver.
(e) The exception shall expire at the end of the calendar year unless otherwise specified by OHPR.
[ED. NOTE: Forms referenced are available from the agency]
Stat. Auth.: ORS 442.466

Stats. Implemented: ORS 442.464 & 442.466

Hist.: OHP 1-2010, f. 2-26-10, cert. ef. 3-1-10
409-025-0150
Compliance and Enforcement
Penalties for failure to comply shall be enforced by OHPR.
(1) Unless approved by a waiver or exception, failure to comply with general reporting requirements shall include but is not limited to:
(a) Failure to submit healthcare claims data files for a required line of business; and
(b) Submitting health information for an excluded line of business.
(2) Unless approved by a waiver or exception, failure to comply with healthcare claims data file requirements shall include but is not limited to:
(a) Submitting a healthcare claims data file in an unapproved layout;
(b) Submitting a data element in an unapproved format;
(c) Submitting a data element with unapproved coding; or
(d) Failure to submit a required data element.
(3) Unless approved by a waiver or exception, failure to comply with healthcare claims data submission requirements shall include but is not limited to:
(a) Failure to submit test files as specified by the data vendor;
(b) Submitting healthcare claims data files later than 30 days after the end of the month;
(c) Rejection of a healthcare claims data file by the data vendor that is not cured by the submitter; or
(d) Transmitting healthcare claims data files using an unapproved process.
(4) OHPR shall provide mandatory reporters written notification of each failure to comply.
(5) OHPR may impose fines of up to $500 per day for each failure to comply that is not cured within 30 calendar days of written notification.
(6) If a mandatory reporter has made documented efforts to comply with OAR 409-025-0100 to 409-025-0170, the Administrator may consider this a mitigating factor.
Stat. Auth.: ORS 442.466 & 442.993

Stats. Implemented: ORS 442.464, 442.466 & 442.993

Hist.: OHP 1-2010, f. 2-26-10, cert. ef. 3-1-10
409-025-0160
Limited and Public Use Data Sets
(1) Public use data
sets.
(a) OHPR
shall maintain an approved list of data elements, described in Appendix F, that
may be included in APAC public use data sets. Appendix F shall comply with applicable
Authority policies and state and federal rules, regulations, and statutes.
(b) Requesters
seeking access to data from the APAC Public Use Data Sets shall complete an Application
for Public Use Data Sets Form (APAC-4) and comply with the application procedures
for public use data sets outlined on the APAC website.
(c) OHPR
shall approve or deny the completed request and provide written notification to
the requester within 30 calendar days of receipt of the request.
(d) OHPR
shall deny the completed request for reasons which include, but are not limited
to:
(A) Requester
or any person who will have access to the data has previously violated a data use
agreement with the Authority.
(B) The Administrator
finds that the general purpose of the study does not serve the public interest.
(C) The Administrator
finds that the specific details of the request do not sufficiently explain the proposed
use.
(D) The Administrator
finds that the specific details of the request violate any state or federal rule,
regulation, or statute.
(E) The Administrator
finds that the specific details of the request violate form APAC-4, Section 3: Data
Use Agreement.
(F) The Administrator
finds that the administrative, technical, and physical safeguards specified in the
request do not sufficiently protect the data set.
(G) Full
payment is not included with the application.
(e) If OHPR
denies the Application for Public Use Data Sets:
(A) OHPR
shall provide written notification stating the reason for the denial; and
(B) The requester
may appeal the denial by requesting a contested case hearing. The appeal must be
filed within 30 business days of the denial. The appeal process is conducted pursuant
to ORS chapter 183 and the Attorney General’s Uniform and Model Rules of Procedure,
OAR 137-003-0501 to 137-003-0700. The requester shall have the burden to prove that
OHPR unreasonably denied the application.
(C) The public
use files may not be used to identify any individual, including but not limited
to patients, physicians, and other health care providers. The requestor may not
use outside information to attempt to ascertain the identity of particular individuals
who are the subject of public use files.
(2) Limited
data sets.
(a) OHPR
shall maintain an approved list of data elements, described in Appendix G, that
may be included in APAC limited data sets.
(b) APAC
limited data sets may be disclosed for research or to a public health authority
for public health purposes.
(c) Researchers
seeking access to the APAC Limited Data Sets shall complete an Application for Limited
Data Sets Form (APAC-5) and comply with the application procedures for limited data
sets outlined on the APAC website.
(d) OHPR
shall review all applications for completeness and provide requesters written notification
of completeness within 30 calendar days of receipt of the request.
(e) If OHPR
determines that the application is incomplete, the requester shall have 30 calendar
days from notification of incompleteness to complete the application. Incomplete
applications that are not completed shall be discarded without further notification
to the requester.
(f) Completed
applications shall be made available for public inspection and written comment for
no fewer than 14 days.
(g) OHPR
shall convene a Privacy and Security Advisory Board to evaluate completed applications
for limited data sets.
(A) The Privacy
and Security Advisory Board shall include:
(i) Authority’s
privacy officer or designee;
(ii) One
representative of the Division of Medical Assistance Programs;
(iii) One
representative of the Addictions and Mental Health Division;
(iv) One
representative of the Public Health Division;
(v) One representative
of the Director’s Office;
(vi) One
representative of an insurer licensed to transact health insurance in Oregon;
(vii) One
representative of a Coordinated Care Organization;
(viii) One
representative of a hospital;
(ix) One
representative of an ambulatory clinic;
(x) One academic
researcher;
(xi) One
other interested person not represented above; and
(xii) One
non-voting chair, appointed by the Administrator.
(B) OHPR
may accept nominations for and make appointments to the Privacy and Security Advisory
Board.
(C) The Privacy
and Security Advisory Board’s review shall include, but is not limited to:
(i) Whether
submitted IRB documentation is sufficient.
(ii) Whether
the proposed disclosure serves the public interest.
(iii) Whether
the proposed disclosure supports the mission and aims of the Authority.
(iv) Whether
the proposed privacy and security protections are sufficient.
(v) Whether
additional clarification is needed to complete the review.
(vi) Public
comments about the completed application.
(D) When
reviewing applications for limited data sets, the Privacy and Security Advisory
Board may request any expert testimony that it deems necessary and appropriate.
(h) OHPR
shall publish a Privacy and Security Advisory Board meeting schedule on its website
and periodically update the number of completed applications scheduled to be reviewed
during each meeting.
(i) OHPR
shall schedule completed applications for limited data sets for review by the Privacy
and Security Advisory Board on a first-come-first-served basis.
(j) The Privacy
and Security Advisory Board shall recommend that OHPR approve the application, deny
the application, defer action pending expert testimony, or defer action pending
clarification from the requester.
(k) OHPR
shall accept or reject the Privacy and Security Advisory Board’s recommendation
and notify the requester within ten business days of the review.
(l) OHPR
shall deny a completed application for reasons which include, but are not limited
to:
(A) Requester
or any person who will have access to the data has previously violated a data use
agreement with the Authority.
(B) Full
payment is not included with the application.
(m) If the
Privacy and Security Advisory Board requests clarification, the requester shall
have 30 calendar days to provide the requested information to OHPR. After 30 calendar
days, applications with incomplete requests for clarification shall be discarded
without further notification to the requester.
(n) Upon
receipt of the requested clarification OHPR shall schedule re-evaluation with the
Privacy and Security Advisory Board on a first-come-first-served basis.
(o) If OHPR
denies the application:
(A) OHPR
shall provide written notification stating the reason for the denial.
(B) The requester
may appeal the denial by requesting a contested case hearing. The appeal must be
filed within 30 business days of the denial. The appeal process is conducted pursuant
to ORS Chapter 183 and the Attorney General’s Uniform and Model rules of Procedure,
OAR 137-003-0501 to 137-003-0700. The requester shall have the burden to prove that
OHPR unreasonably denied the application.
Stat. Auth.: ORS
442.466

Stats. Implemented:
ORS 442.464 & 442.466

Hist.: OHP
1-2010, f. 2-26-10, cert. ef. 3-1-10; OHP 4-2012, f. 5-23-12, cert. ef. 6-1-12;
OHP 2-2013, f. 1-24-13, cert. ef. 2-1-13
409-025-0170
Public Disclosure
(1) OHPR shall convene an advisory group to provide recommendations for developing a comprehensive health information system no later than June 1, 2010. The advisory group shall include, but not be limited to representatives from:
(a) Carriers;
(b) TPAs;
(c) PBMs;
(d) MCOs; and
(e) Other stakeholders and interested parties.
(2) OHPR, applicable contractors, and other entities inside the Authority shall perform data analyses and publish data and reports that serve the public’s interest. This may include, but is not limited to:
(a) Comparing healthcare cost and quality;
(b) Assessing health care utilization;
(c) Assessing the capacity and distribution of healthcare resources;
(d) Assessing health care purchasing decisions;
(e) Assessing the effectiveness of public health programs; or
(f) Assessing disparities in health care delivery and outcomes.
(3) OHPR may convene advisory groups to advise OHPR on topics related to the All-Payer Healthcare Claims Data Reporting Program. The advisory groups shall include, but not be limited to representatives from:
(a) Carriers;
(b) TPAs;
(c) PBMs;
(d) MCOs; and
(e) Other stakeholders and interested parties.
Stat. Auth.: ORS 442.466

Stats. Implemented: ORS 442.464 & 442.466

Hist.: OHP 1-2010, f. 2-26-10, cert. ef. 3-1-10




The official copy of an Oregon Administrative Rule is
contained in the Administrative Order filed at the Archives Division,
800 Summer St. NE, Salem, Oregon 97310. Any discrepancies with the
published version are satisfied in favor of the Administrative Order.
The Oregon Administrative Rules and the Oregon Bulletin are
copyrighted by the Oregon Secretary of State. Terms
and Conditions of Use