Loading
The Oregon Administrative Rules contain OARs filed through September 15, 2014
 
QUESTIONS ABOUT THE CONTENT OR MEANING OF THIS AGENCY'S RULES?
CLICK HERE TO ACCESS RULES COORDINATOR CONTACT INFORMATION

 

OREGON HEALTH AUTHORITY,
PUBLIC HEALTH DIVISION

 

DIVISION 25

GENETIC INFORMATION AND PRIVACY

333-025-0100

Definitions

As used in these rules:

(1) "Anonymous research" means scientific or medical genetic research conducted in such a manner that any DNA sample or genetic information used in the research is unidentified. "Anonymous research" does not include research conducted in such a manner that the identity of such an individual, or the identity of the individual's blood relatives, can be determined by use of a code, encryption key or other means of linking the information to a specific individual.

(2) "Biological sample" means any human biological specimen that may be used as a DNA sample.

(3) "Blanket informed consent" means that the individual has consented to the use of that individual's DNA sample or health information for any future research, but has not been provided with a description of or consented to the use of the sample in genetic research or any specific genetic research project.

(4) "Blood relative" means a person who is:

(a) Related by blood to an individual; and

(b) A parent, sibling, son, daughter, grandparent, grandchild, aunt, uncle, first cousin, niece or nephew of the individual.

(5) "Clinical" means relating to or obtained through the actual observation, diagnosis, or treatment of patients and not through research.

(6) "Coded" means identifiable only through the use of a system of encryption that links a DNA sample or genetic information to an individual or the individual's blood relative. A coded DNA sample or genetic information is supplied by a repository to an investigator with a system of encryption.

(7) "Covered entity," as applied to a health care provider, means a health care provider that transmits any health information in electronic form to carry out financial or administrative activities in connection with a transaction covered by ORS 192.518 to 192.524.

(8) "Deidentified" means lacking, or having had removed, the identifiers or system of encryption that would make it possible for a person to link a biological sample or health information to an individual or the individual's blood relative, and neither the investigator nor the repository can reconstruct the identity of the individual from whom the sample or information was obtained. DNA samples and genetic information will be considered deidentified only if they meet the following standards provided in the Federal Privacy Rule:

(a) A person with appropriate knowledge of and experience with generally accepted statistical and scientific principles and methods for rendering information not individually identifiable:

(A) Applying such principles and methods, determines that the risk is very small that the information could be used, alone or in combination with other reasonably available information, by an anticipated recipient to identify an individual who is a subject of the information; and

(B) Documents the methods and results of the analysis that justify such determination; or

(b) The following identifiers of the individual or of relatives, employers, or household members of the individual, are removed:

(A) Names;

(B) All geographic subdivisions smaller than a state, including street address, city, county, precinct, zip code, and their equivalent geocodes, except for the initial three digits of a zip code if, according to the current publicly available data from the Bureau of the Census:

(i) The geographic unit formed by combining all zip codes with the same three initial digits contains more than 20,000 people; and

(ii) The initial three digits of a zip code for all such geographic units containing 20,000 or fewer people is changed to 000.

(C) All elements of dates (except year) for dates directly related to an individual, including birth date, admission date, discharge date, date of death; and all ages over 89 and all elements of dates (including year) indicative of such age, except that such ages and elements may be aggregated into a single category of age 90 or older;

(D) Telephone numbers;

(E) Fax numbers;

(F) Electronic mail addresses;

(G) Social security numbers;

(H) Medical record numbers;

(I) Health plan beneficiary numbers;

(J) Account numbers;

(K) Certificate/license numbers;

(L) Vehicle identifiers and serial numbers, including license plate numbers;

(M) Device identifiers and serial numbers;

(N) Web Universal Resource Locators (URLs);

(O) Internet Protocol (IP) address numbers;

(P) Biometric identifiers, including finger and voice prints;

(Q) Full face photographic images and any comparable images; and

(R) Any other unique identifying number, characteristic, or code; and

(c) The investigator and repository do not have actual knowledge that the information could be used alone or in combination with other information to identify an individual who is a subject of the information.

(9) "Direct provider" means a health care provider that is not an indirect treatment provider.

(10) "Disclose" means to release, publish, or otherwise make known to a third party a biological sample or health information.

(11) "DNA" means deoxyribonucleic acid.

(12) "DNA sample" means any human biological specimen that is obtained or retained for the purpose of extracting and analyzing the individual's DNA to perform a genetic test. "DNA sample" includes DNA extracted from the specimen.

(13) "Federal Common Rule" means the Federal Policy for the Protection of Human Subjects, as adopted by the following federal agencies and as revised through November 13, 2001: 7 CFR Part 1c, Department of Agriculture; 10 CFR Part 745, Department of Energy; 14 CFR Part 1230, National Aeronautics and Space Administration; 15 CFR Part 27, Department of Commerce; 16 CFR Part 1028, Consumer Product Safety Commission; 21 CFR Parts 50 and 56, Food and Drug Administration; 22 CFR Part 225, International Development Cooperation Agency, Agency for International Development; 24 CFR Part 60, Department of Housing and Urban Development; 28 CFR Part 46, Department of Justice; 32 CFR Part 219, Department of Defense; 34 CFR Part 97, Department of Education; 38 CFR Part 16, Department of Veterans Affairs; 40 CFR Part 26, Environmental Protection Agency; 45 CFR Part 690, National Science Foundation; 45 CFR Part 46, Department of Health and Human Services; 49 CFR Part 11, Department of Transportation. In the case of research not subject to federal regulation under one of these provisions, "Federal Common Rule" means 45 CFR Part 46.

(14) "Federal Privacy Rule" means the federal regulations under the Health Insurance Portability and Accountability Act, 45 CFR parts 160 and 164.

(15) "Genetic characteristic" includes a gene, chromosome or alteration thereof that may be tested to determine the existence or risk of a disease, disorder, trait, propensity or syndrome or to identify an individual or a blood relative. "Genetic characteristic" does not include family history or a genetically transmitted characteristic whose existence or identity is determined other than through a genetic test.

(16) "Genetic information" means information about an individual or the individual's blood relatives obtained from a genetic test.

(17) "Genetic research" means research using human DNA samples, genetic testing or genetic information.

(18) "Genetic test" means a test for determining the presence or absence of genetic characteristics in a human individual or the individual's blood relatives, including tests of nucleic acids such as DNA, RNA, and mitochondrial DNA, chromosomes or proteins in order to diagnose or determine a genetic characteristic.

(19) "Health care facility" means a hospital, long term care facility, an ambulatory surgical center, a freestanding birthing center or an outpatient dialysis center. "Health care facility" does not mean:

(a) An establishment furnishing residential care or treatment not meeting federal intermediate care standards, not following a primarily medical model of treatment, prohibited from admitting persons requiring 24-hour nursing care and licensed or approved under the rules of the Oregon Health Authority, Department of Human Services or the Department of Corrections; or

(b) An establishment furnishing primarily domiciliary care.

(20) "Health care provider" has the meaning given in ORS 192.519(5).

(21) "Health information" means any information in any form or medium that:

(a) Is created or received by a health care provider, a state health plan, a health insurer, a healthcare clearinghouse, a public health authority, an employer, a life insurer, a school, or a university; and

(b) Relates to:

(A) The past, present or future physical or mental health or condition of an individual;

(B) The provision of health care to an individual; or

(C) The past, present or future payment for the provision of health care to an individual.

(22) "Human biological specimen" means any material derived from human subjects, such as blood, urine, tissues, organs, hair, nail clippings, or any other cells or fluids, whether collected for research purposes or as residual specimens from diagnostic, therapeutic, or surgical procedures.

(23) "Identifiable" or "Individually identifiable" means capable of being linked to the individual or a blood relative of the individual from whom the biological sample or health information was obtained, including demographic information that identifies the individual, or for which there is a reasonable basis to believe the information can be used to identify an individual.

(24) "Identified" means having an identifier that links, or that could readily allow the recipient to link, a DNA sample or genetic information directly to the individual or a blood relative of the individual from whom the sample or information was obtained.

(25) "Identifier" means data elements that directly link a DNA sample or genetic information to the individual or a blood relative of the individual from whom the sample or information was obtained. Identifiers include, but are not limited to, names, telephone numbers, electronic mail addresses, Social Security numbers, driver license numbers and fingerprints.

(26) "Indirect provider" means a health care provider having a relationship with an individual in which:

(a) The health care provider delivers health care to the individual based on the orders of another health care provider; and

(b) The health care provider typically provides services or products, or reports the diagnosis or results associated with the health care, directly to another health care provider, who provides the services or products or reports to the individual.

(27) "Institutional Review Board" or "IRB" means an Institutional Review Board established in accord with and for the purposes expressed in the Federal Common Rule.

(28) "IRB approval" means the determination of the IRB that the research has been reviewed and may be conducted within the constraints set forth by the IRB and by other institutional and Federal and State requirements.

(29) "Limited data set" means protected health information that, in accordance with the Federal Privacy Rule, excludes the following direct identifiers of the individual or of relatives, employers, or household members of the individual:

(a) Names;

(b) Postal address information, other than town or city, state, and zip code;

(c) Telephone numbers;

(d) Fax numbers;

(e) Electronic mail addresses;

(f) Social security numbers;

(g) Medical record numbers;

(h) Health plan beneficiary numbers;

(i) Account numbers;

(j) Certificate/license numbers;

(k) Vehicle identifiers and serial numbers, including license plate numbers;

(l) Device identifiers and serial numbers;

(m) Web Universal Resource Locators (URLs);

(n) Internet Protocol (IP) address numbers;

(o) Biometric identifiers, including finger and voice prints; and

(p) Full face photographic images and any comparable images.

(30) "Obtain genetic information" means performing or getting the results of a genetic test.

(31) "Opt-out statement" means a written expression of an individual's desire to withhold his or her own biological specimen or clinical individually identifiable health information from use and disclosure for the purpose of anonymous research or coded research.

(32) "Person" includes but is not limited to any health care provider, health care facility, clinical laboratory, blood or sperm bank, insurer, insurance agent, insurance-support organization, as defined in ORS 746.600, government agency, employer, research organization or agent of any of them.

(33) "Personal representative" includes but is not limited to:

(a) A person appointed as a guardian under ORS 125.305, 419B.370, 419C.481 or 419C.555 with authority to make medical and health care decisions;

(b) A person appointed as a health care representative under ORS 127.505 to 127.660 or a representative under ORS 127.700 to 127.737 to make health care decisions or mental health treatment decisions; and

(c) A person appointed as a personal representative under ORS Chapter 113.

(34) "Recontact" means disclosure of genetic research findings to a research subject or the subject's physician through use of personal identifiers.

(35) "Research" means a systematic investigation, including research development, testing and evaluation, designed to develop or contribute to generalized knowledge.

(36) "Retain a DNA sample" means the act of storing the DNA sample.

(37) "Retain genetic information" means making a record of the genetic information.

(38) "Specific informed consent for genetic research" means the individual or the individual's representative has consented to the use of that individual's DNA sample or genetic information for genetic research or for a specified genetic research project.

(39) "Unidentified" means deidentified or not identifiable.

[Publications: Publications referenced are available from the agency.]

Stat. Auth.: ORS 192.531
Stats. Implemented: ORS 192.531
Hist.: OHD 14-2002, f. & cert. ef. 9-27-02; PH 16-2003(Temp), f. & cert. ef. 10-27-03 thru 4-16-04; PH 9-2004, f. & cert. ef. 3-23-04; PH 21-2005, f. 12-30-05, cert. ef. 1-1-06; PH 5-2011(Temp), f. & cert. ef. 7-1-11 thru 12-27-11; PH 11-2011, f. & cert. ef. 10-27-11

Research Involving Human Genetic Materials

333-025-0105

Scope

(1) OAR 333-025-0100 to 0165 apply to all genetic research subject to the law of the State of Oregon.

(2) All genetic research must comply with the applicable standards set forth in the Federal Common Rule. Additional protections for subjects of research are authorized by ORS 192.531 et seq. and these rules. These rules set state standards that are in addition to, and not intended to alter, any requirements under the Federal Common Rule or the Federal Privacy Rule.

Stat. Auth.: ORS 192.531-192.549
Stats. Implemented: ORS 192.531-192.549
Hist.: OHD 14-2002, f. & cert. ef. 9-27-02; PH 16-2003(Temp), f. & cert. ef. 10-27-03 thru 4-16-04; PH 9-2004, f. & cert. ef. 3-23-04; PH 21-2005, f. 12-30-05, cert. ef. 1-1-06

333-025-0110

Institutional Review Boards (IRBs) and Approval for Research

(1) An IRB must conform to the organizational and operational standards contained in the Federal Common Rule.

(2) All proposed genetic research, including anonymous research, or research otherwise exempt from IRB approval, must first be submitted to an IRB for explicit prior approval or an explicit determination that the research is anonymous or otherwise exempt.

(3) A researcher must disclose to the IRB the intended use of human DNA samples, genetic tests or other genetic information for every proposed research project, including anonymous or otherwise exempt research.

(4) A researcher must follow the requirements of OAR 333-025-0115 and 333-025-0120 and provide assurances to the IRB that these requirements have been met.

Stat. Auth.: ORS 192.547
Stats. Implemented: ORS 192.533 & 192.547
Hist.: OHD 14-2002, f. & cert. ef. 9-27-02; PH 16-2003(Temp), f. & cert. ef. 10-27-03 thru 4-16-04; PH 9-2004, f. & cert. ef 3-23-04; PH 21-2005, f. 12-30-05, cert. ef. 1-1-06

333-025-0115

Informed Consent for Non-Exempt Genetic Research

(1) Except as provided in OAR 333-025-0120, a researcher may use an identified human biological sample or genetic information obtained on or after June 25, 2001, for genetic research only with specific informed consent for genetic research.

(2) Except as provided in OAR 333-025-0120, a researcher may use an identified human biological sample or genetic information obtained prior to June 25, 2001, for genetic research with blanket informed consent or specific informed consent for genetic research.

Stat. Auth.: ORS 192.535 & 192.547
Stats. Implemented: ORS 192.535 & 192.547
Hist.: OHD 14-2002, f. & cert. ef. 9-27-02; PH 16-2003(Temp), f. & cert. ef. 10-27-03 thru 4-16-04; PH 9-2004, f. & cert. ef 3-23-04; PH 21-2005, f. 12-30-05, cert. ef. 1-1-06

333-025-0120

Anonymous, Coded, or Exempt Genetic Research

(1) Any person proposing to conduct genetic research that is thought to be anonymous shall obtain from an IRB, prior to conducting such research, a determination that the research is anonymous. The person shall furnish the IRB with assurances that the criteria in (3) below are met.

(2) Any person proposing to conduct research that is thought to be exempt from review shall obtain an IRB determination that the research is exempt from review under 45 CFR 46.101(b) or other applicable exemption from the Federal Common Rule.

(3) A human biological sample or clinical individually identifiable health information may be used in anonymous or coded genetic research only if prior to the time the research is conducted:

(a) The subject has granted informed consent for the specific anonymous or coded research project; or

(b) The subject has granted consent for genetic research generally; or

(c) The subject was notified in accordance with OAR 333-025-0165 that the individual's sample or information may be used for anonymous or coded research, and before the sample or information was obtained, the subject did not request that the sample or information be withheld from anonymous or coded research; or

(d) The subject was not notified, due to emergency circumstances, in accordance with OAR 333-025-0165, that the individual's sample or information may be used for anonymous research or coded research, and the individual died before receiving the notice; or

(e) The subject has granted blanket informed consent and the sample or information was obtained before June 25, 2001; or

(f) The subject was deceased when the sample or information was obtained; or

(g) An Institutional Review Board:

(A) Waives or alters the consent requirements pursuant to the Federal Common Rule; and

(B) Waives authorization pursuant to the Federal Privacy Rule.

(4) In addition to the requirements of section (3) of this rule, genetic research in which the DNA sample or genetic information is coded shall satisfy the following requirements:

(a) The research has been approved by an Institutional Review Board after disclosure by the investigator to the board of risks associated with the coding;

(b) The code is:

(A) Not derived from individual identifiers;

(B) Kept securely and separately from the DNA samples and genetic information; and

(C) Not accessible to the investigator unless specifically approved by the Institutional Review Board.

(c) Data is stored securely in password protected electronic files or by other means with access limited to necessary personnel;

(d) The data is limited to elements required for analysis and is a limited data set; and

(e) The investigator is a party to a data use agreement with any limited data set recipient. The data use agreement must:

(A) Establish the permitted uses and disclosures of such information by the limited data set recipient, limited to research uses. The data use agreement may not authorize the limited data set recipient to use or further disclose the information in a manner that would violate the requirements of the Federal Privacy Rule, if done by the investigator;

(B) Establish who is permitted to use or receive the limited data set; and

(C) Provide that the limited data set recipient will:

(i) Not use or further disclose the information other than as permitted by the data use agreement or as otherwise required by law;

(ii) Use appropriate safeguards to prevent use or disclosure of the information other than as provided for by the data use agreement;

(iii) Report to the investigator any use or disclosure of the information not provided for by its data use agreement of which it becomes aware;

(iv) Ensure that any agents, including a subcontractor, to whom it provides the limited data set agrees to the same restrictions and conditions that apply to the limited data set recipient with respect to such information; and

(v) Not identify the information or contact the individuals.

Stat. Auth.: ORS 192.537 & 192.547
Stats. Implemented: ORS 192.535, 192.537 & 192.547
Hist.: OHD 14-2002, f. & cert. ef. 9-27-02; PH 16-2003(Temp), f. & cert. ef. 10-27-03 thru 4-16-04; PH 9-2004, f. & cert. ef 3-23-04; PH 21-2005, f. 12-30-05, cert. ef. 1-1-06

333-025-0125

IRB Registry

(1) The Oregon Health Authority, Public Health Division shall establish and maintain a registry of IRBs that review research conducted in Oregon or that involves research subjects living in Oregon.

(2) By October 1, 2002, each existing IRB must register with the Oregon Health Authority, Public Health Division on registration forms provided by the Authority.

(3) The Authority will update its registry annually. Each IRB will be required to renew its registration each year, or sooner if there exists material changes in the terms of registration.

Stat. Auth.: ORS 192.547
Stats. Implemented: ORS 192.547
Hist.: OHD 14-2002, f. & cert. ef. 9-27-02; PH 16-2003(Temp), f. & cert. ef. 10-27-03 thru 4-16-04; PH 9-2004, f. & cert. ef 3-23-04

333-025-0130

Recontact

(1) Recontact of a research subject should not occur unless the subject was informed during the initial consent process that recontact may occur under specified circumstances and with this understanding, the research subject consented to participate in the study.

(2) If recontact of subjects is contemplated, the researcher must provide research protocols to the IRB describing the circumstances that might lead to recontact, as well as a plan for managing the process. If a subject declines the possibility of recontact, the researcher may not recontact the subject.

(3) Notwithstanding (1) above, in order to consider recontact in a situation where recontact was not contemplated and therefore not addressed in research protocols a researcher must seek approval from the IRB for re-contact and must assure the following conditions exist:

(a) The findings are scientifically valid and confirmed;

(b) The findings have significant implications for the subject's or the public's health; and

(c) A course of action to ameliorate or treat the subject's or the public's health concerns is readily available.

(4) Under conditions described in (3), the researcher shall determine and adhere to the expressed wishes and desires of the research subject in relation to disclosure of genetic information to that individual.

(5) When research results are disclosed to a subject, appropriate medical advice and referral must be provided.

(6) In all cases, a decision to recontact research subjects must have prior approval of the IRB.

Stat. Auth.: ORS 192.547
Stats. Implemented: ORS 192.547
Hist.: OHD 14-2002, f. & cert. ef. 9-27-02; PH 16-2003(Temp), f. & cert. ef. 10-27-03 thru 4-16-04; PH 9-2004, f. & cert. ef 3-23-04

Obtaining Genetic Information for Identification of Deceased Individuals

333-025-0135

Information Concerning Deceased Individuals

(1) Anyone permitted by Oregon law to dispose of the body of a deceased individual or who is authorized by ORS 146.113 to 146.117 to submit the DNA sample of an unidentified deceased individual to a DNA diagnostic laboratory may obtain or retain genetic information for the purpose of identification of the deceased. After identification, relevant information concerning the death shall be submitted into the permanent medical record of the deceased.

(2) A DNA sample of or genetic information about a deceased individual may be used for medical diagnosis of blood relatives of the individual and for no other purpose except as otherwise authorized by law. A request to use a sample or information for such purpose may be made by:

(a) A representative designated by the decedent to act on the individual's behalf after death;

(b) The closest surviving blood relative of the decedent; or

(c) If there is more than one surviving blood relative of the same degree of relationship to the decedent, by the majority of the surviving closest blood relatives of the decedent.

(3) A DNA sample sent to a diagnostic laboratory for testing under Section (1) or (2) of this rule must be accompanied by an affidavit stating that the specific purpose for obtaining the DNA sample is to identify the deceased individual or is for medical diagnosis of blood relatives of the decedent, and for no other purpose.

(4) A person may use an individual's DNA sample or genetic information that is derived from a biological specimen or clinical individually identifiable health information for anonymous research or coded research, if the individual was deceased when the individual's biological specimen or clinical individually identifiable health information was obtained (OAR 333-025-0120).

Stat. Auth.: ORS 192.535, 192.537 & 192.539
Stats. Implemented: ORS 192.535, 192.537 & 192.539
Hist.: HD 1-1997, f. & cert. ef. 1-10-97; Renumbered from 333-024-0500 by OHD 14-2002, f. & cert. ef. 9-27-02; Renumbered from 333-024-0500 by PH 16-2003(Temp), f. & cert. ef. 10-27-03 thru 4-16-04; Renumbered from 333-024-0500 by PH 9-2004, f. & cert. ef. 3-23-04; PH 21-2005, f. 12-30-05, cert. ef. 1-1-06

Informed Consent for Obtaining Genetic Information

333-025-0140

Informed Consent Procedures

(1) Unless exempted by ORS 192.535(1)(a)-(f), all persons collecting genetic information must conform to standards of informed consent as follows:

(a) Physicians licensed under ORS Chapter 677, and any other licensed health care providers or facilities, shall obtain informed consent according to ORS 677.097;

(b) Except as provided in OAR 333-025-0120, a person conducting research shall obtain informed consent according to the procedure given in OAR 333-025-0115; and

(c) If genetic information is collected in connection with an insurance transaction governed by ORS 746.135, informed consent will be conducted in the manner described by the Department of Consumer and Business Services under authority of ORS 746.135(1).

(2) For persons not described in (1) above, informed consent must be obtained using the form and process contained in Appendix 1 of these rules or a form which is substantively similar.

(3) Elements to be contained in a consent form for obtaining genetic information include:

(a) The name of the individual whose DNA sample is to be tested;

(b) The name of the individual, company, or organization requesting the genetic test for the purpose of obtaining genetic information;

(c) A statement signed by the individual whose DNA sample is to be tested indicating that he/she authorizes the genetic test; and

(d) A statement that specifies the purpose of the test and the genetic characteristic for which the DNA sample will be tested.

(4) Process for obtaining informed consent using the form contained in Appendix 1 or a form that is substantively similar:

(a) Explain that the genetic test is voluntary;

(b) Inform the individual that he/she may choose not to have his/her DNA sample tested;

(c) Inform the individual that he/she has the option of withdrawing consent at any time;

(d) Explain the risks and benefits of having the genetic test, including:

(A) A description of the provisions of Oregon law pertaining to individual rights with regard to genetic information and the confidential nature of the genetic information;

(B) A statement of potential consequences with regard to insurability, employability, and social discrimination if the genetic test results or genetic information become known to others;

(C) The implications of both positive and negative test results; and

(D) The availability of support services, including genetic counseling.

(e) Inform the individual that it may be in his/her best interest to retain his/her DNA sample for future diagnostic testing, but that he/she has the right to have his/her DNA sample promptly destroyed after completion of the specific genetic test which was authorized;

(f) Inform the individual about the implications, including potential insurability, of authorizing disclosure to a third party payer that the genetic test was performed, and that he/she has the option of paying the cost of the genetic test out of pocket rather than filing an insurance claim;

(g) Ask the individual whether he/she has any further questions, and if so, provide the individual with the opportunity to ask questions and receive answers from either a genetic counselor or another person who is sufficiently knowledgeable to give accurate, understandable and complete answers to his/her questions;

(h) Request that the individual read, complete, sign and date the consent form; and

(i) Provide the individual with a copy of the completed form for his/her personal records.

[Forms and Appendices referenced are available from the agency.]

Stat. Auth.: ORS 192.535
Stats. Implemented: ORS 192.535
Hist.: HD 1-1997, f. & cert. ef. 1-10-97; Renumbered from 333-024-0510 by OHD 14-2002, f. & cert. ef. 9-27-02; Renumbered from 333-024-0510 by PH 16-2003(Temp), f. & cert. ef. 10-27-03 thru 4-16-04; Renumbered from 333-024-0510 by PH 9-2004, f. & cert. ef 3-23-04; PH 21-2005, f. 12-30-05, cert. ef. 1-1-06

Retention of Genetic Information

333-025-0145

Retention for the Purpose of Identification of Deceased Individuals

(1) Any person who is permitted by Oregon law to dispose of the body of a deceased individual, or anyone who is authorized by ORS 146.113-117 may retain the genetic information obtained from an unidentified deceased individual's DNA sample without specific authorization for the purpose of identification of the deceased individual.

(2) Upon identification of the deceased individual, persons so authorized in Section (1) shall convey the deceased individual's genetic information to his/her permanent medical record.

Stat. Auth.: ORS 192.537 & 192.539
Stats. Implemented: ORS 192.537 & 192.539
Hist.: HD 1-1997, f. & cert. ef. 1-10-97; Renumbered from 333-024-0520 by OHD 14-2002, f. & cert. ef. 9-27-02; Renumbered from 333-024-0520 by PH 16-2003(Temp), f. & cert. ef. 10-27-03 thru 4-16-04; Renumbered from 333-024-0520 by PH 9-2004, f. & cert. ef 3-23-04

333-025-0150

Retention for the Purpose of Testing to Benefit Blood Relatives of Deceased Individuals

Any person may retain the genetic information of a deceased individual indefinitely for the sole purpose of benefiting blood relatives of the deceased individual without specific authorization.

Stat. Auth.: ORS 192.535 & 192.537
Stats. Implemented: ORS 192.535 & 192.537
Hist.: HD 1-1997, f. & cert. ef. 1-10-97; Renumbered from 333-024-0530 by OHD 14-2002, f. & cert. ef. 9-27-02; Renumbered from 333-024-0530 by PH 16-2003(Temp), f. & cert. ef. 10-27-03 thru 4-16-04; Renumbered from 333-024-0530 by PH 9-2004, f. & cert. ef 3-23-04

333-025-0155

Retention for the Purpose of Newborn Screening Procedures

The Oregon Health Authority may retain the blood samples of newborns collected for the control of metabolic diseases, as provided in ORS 433.285, for up to one year.

Stat. Auth.: ORS 433.285, 192.535 & 192.537
Stats. Implemented: ORS 192.535 & 192.537
Hist.: HD 1-1997, f. & cert. ef. 1-10-97; Renumbered from 333-024-0540 by OHD 14-2002, f. & cert. ef. 9-27-02; Renumbered from 333-024-0540 by PH 16-2003(Temp), f. & cert. ef. 10-27-03 thru 4-16-04; Renumbered from 333-024-0540 by PH 9-2004, f. & cert. ef 3-23-04

Disclosure of Genetic Information

333-025-0160

Procedure for Authorization of Disclosure by the Tested Individual or the Tested Individual's Representative

Except as provided in ORS 192.539, and except for research disclosures authorized by an Institutional Review Board in accordance with these rules, any person shall be required to obtain specific authorization from the individual on whose sample a genetic test was conducted, or an individual's representative, to disclose genetic information, by completing the consent form specified in ORS 192.522, or a form that is substantively similar and by using the following procedure:

(1) Request that the tested individual, or his/her representative, read, sign and date the prescribed consent form; and

(2) Read, sign, and date the prescribed consent form on behalf of the individual or organization requesting the release of genetic information; and

(3) Provide the tested individual, or his/her representative, with a copy of the completed consent form for his/her personal records.

Stat. Auth.: ORS 192.539
Stats. Implemented: ORS 192.539
Hist.: HD 1-1997, f. & cert. ef. 1-10-97; Renumbered from 333-024-0550 by OHD 14-2002, f. & cert. ef. 9-27-02; Renumbered from 333-024-0550 by PH 16-2003(Temp), f. & cert. ef. 10-27-03 thru 4-16-04; Renumbered from 333-024-0550 by PH 9-2004, f. & cert. ef 3-23-04; PH 21-2005, f. 12-30-05, cert. ef. 1-1-06

333-025-0165

Provider Notification and Opt Out

(1) A direct provider that is a covered entity and who obtains a biological specimen or clinical individually identifiable health information from an individual must:

(a) Notify the individual or his/her personal representative, in accordance with this rule, that the individual's biological specimen or clinical individually identifiable health information may be used or disclosed for anonymous or coded research; and

(b) Give the individual the opportunity to make an opt-out statement.

(2) Any health care provider that is not described in Section (1) of this rule may, but is not required to, furnish the notification and opportunity for an opt-out statement described in Section (1) of this rule.

(3) A health care provider described in Section (1) of this rule must provide notification no later than the time required for federal privacy notices by the Federal Privacy Rule for services rendered on or after July 1, 2006 (see 45 CFR 164.520).

(4) If a health care provider is required to provide notification pursuant to Section (1) of this rule, the health care provider must provide notification at least once per individual, regardless of how many times the provider obtains the individual's biological specimen or clinical individually identifiable health information.

(5) If a health care facility provides the notice pursuant to Section (1) of this rule, a health care provider providing care to patients in the health care facility is not required to provide an additional notice with respect to services provided in the facility.

(6) Notification may be delivered in a manner determined by the health care provider within the requirements of this rule, including but not limited to any manner permitted for the provision of the notice of privacy practices required under the Federal Privacy Rule.

(7) Notification must include:

(a) A place where the individual may mark to indicate the individual's opt-out statement;

(b) A general explanation of the meaning of anonymous and coded research;

(c) A statement describing that the biological specimen or clinical individually identifiable health information may be used at some undetermined point in the future without further notice to the individual;

(d) A statement that a refusal to allow use of biological specimens or clinical individually identifiable health information will not affect access to or provision of health care by the provider originally providing notice;

(e) A statement specifying that the individual retains the right to make or revoke an opt-out statement by submitting in writing such a request to the health care provider originally providing notice;

(f) A statement indicating that an opt-out statement will be valid from the date received by the health care provider;

(g) A prominent heading indicating the purpose of the notice; and

(h) The name, or title, and telephone number or other contact information of a person or office to contact for further information.

(8) If a health care provider is required to provide notification pursuant to Section (1) of this rule, notification may be, but is not required to be, provided using the form contained in Appendix 2 of these rules.

(9) Any health care provider described by Section (1) of this rule that receives an opt-out statement of an individual must, at the time of disclosure of a biological specimen or clinical individually identifiable health information, inform the indirect provider that is the intended recipient that the individual's biological specimen or clinical individually identifiable health information is subject to an opt out statement.

(a) Methods to inform the indirect provider may include, but shall not be limited to, marking or noting the biological specimen container or clinical individually identifiable health information as subject to an opt-out statement. The mark or notation may be in any form that can be understood by the intended recipient.

(b) If an opt-out statement is received after the completion of the first service delivery and within the first fourteen (14) days from the completion of the first service delivery, a health care provider is encouraged, but is not required, to make a good faith effort to inform the indirect health care provider of the opt-out statement.

(c) Any recipient of an individual's biological specimen or clinical individually identifiable health information from a health care provider described by Section (1) of this rule that is not informed of the individual's opt-out statement within fourteen (14) calendar days of receipt may presume that the individual has not made an opt-out statement.

(10) Any health care provider subject to Section (1) of this rule must have a process in place to demonstrate compliance with this rule.

[ED. NOTE: Forms and appendices referenced are available from the agency.]

Stat. Auth.: ORS 192.547
Stats. Implemented: ORS 192.531 - 192.549
Hist.: PH 21-2005, f. 12-30-05, cert. ef. 1-1-06

The official copy of an Oregon Administrative Rule is contained in the Administrative Order filed at the Archives Division, 800 Summer St. NE, Salem, Oregon 97310. Any discrepancies with the published version are satisfied in favor of the Administrative Order. The Oregon Administrative Rules and the Oregon Bulletin are copyrighted by the Oregon Secretary of State. Terms and Conditions of Use

Oregon Secretary of State • 136 State Capitol • Salem, OR 97310-0722
Phone: (503) 986-1523 • Fax: (503) 986-1616 • oregon.sos@state.or.us

© 2013 State of Oregon All Rights Reserved​