Loading
The Oregon Administrative Rules contain OARs filed through July 15, 2014
 
QUESTIONS ABOUT THE CONTENT OR MEANING OF THIS AGENCY'S RULES?
CLICK HERE TO ACCESS RULES COORDINATOR CONTACT INFORMATION

 

OREGON HEALTH AUTHORITY, OFFICE FOR OREGON HEALTH POLICY AND RESEARCH

 

DIVISION 25

ALL-PAYER HEALTHCARE CLAIMS DATA REPORTING PROGRAM

409-025-0100

Definitions

The following definitions apply to OAR 409-025-0100 to 409-025-0170:

(1) “Accident policy” means an insurance policy that provides benefits only for a loss due to accidental bodily injury.

(2) “Administrator” means the administrator of the Office for Oregon Health Policy and Research.

(3) “Allowed amount” means the actual amount of charges for healthcare services, equipment, or supplies that are covered expenses under the terms of an insurance policy or health benefits plan.

(4) “Association” means any organization, including a labor union, that has an active existence for at least one year, that has a constitution and bylaws and that has been organized and is maintained in good faith primarily for purposes other than that of obtaining insurance.

(5) “Attending provider” means the individual health care provider who delivered the health care services, equipment, or supplies specified on a health care claim.

(6) “Authority” means the Oregon Health Authority.

(7) “Billing provider” means the individual or entity that submits claims for health care services, equipment, or supplies delivered by an attending provider.

(8) “Capitated services” means services rendered by a provider through a contract in which payments are based upon a fixed dollar amount for each enrolled member on a monthly basis.

(9) “Carrier” shall have the meaning given that term in ORS 743.730(6).

(10) “Certificate of authority” shall have the meaning given that term in ORS 731.072.

(11) “Charges” means the actual dollar amount charged on the claim.

(12) “Claim” means an encounter or request for payment under the terms of an insurance policy, health benefits plan, Medicare, or Medicaid.

(13) "Co-insurance" means the percentage an enrolled member pays toward the cost of a covered service.

(14) “Coordinated Care Organization (CCO)” shall have the meaning given that term in ORS 414.025(5).

(15) "Co-payment" means the fixed dollar amount an enrolled member pays to a health care provider at the time a covered service is provided or the full cost of a service when that is less than the fixed dollar amount.

(16) “Current Procedural Terminology(CPT)” means a medical code set of physician and other services, maintained and copyrighted by the American Medical Association, and adopted by the U.S. Secretary of Health and Human Services as the standard for reporting physician and other services on standard transactions.

(17) “Data set” means a collection of individual data records, whether in electronic or manual files.

(18) “DCBS” means the Oregon Department of Consumer and Business Services.

(19) “Deductible” means the total dollar amount an enrolled member pays toward the cost of covered services over an established period of time before the carrier or third-party administrator makes any payments under an insurance policy or health benefit plan.

(20) “De-identified health information” means health information that does not identify an individual and with respect to which there is no reasonable basis to believe that the information can be used to identify an individual.

(21) “Direct personal identifier” means information relating to an individual patient or enrolled member that contains primary or obvious identifiers, including:

(a) Names;

(b) Business names when that name would serve to identify a person;

(c) Postal address information other than town or city, state, and 5-digit zip code;

(d) Specific latitude and longitude or other geographic information that would be used to derive postal address;

(e) Telephone and fax numbers;

(f) Electronic mail addresses;

(g) Social security numbers;

(h) Vehicle identifiers and serial numbers, including license plate numbers;

(i) Medical record numbers;

(j) Health plan beneficiary numbers;

(k) Certificate and license numbers;

(l) Internet protocol (IP) addresses and uniform resource locators (URL) that identify a business that would serve to identify a person;

(m) Biometric identifiers, including finger and voice prints; and

(n) Personal photographic images.

(22) “Director’s Office” means the Director’s Office of the Oregon Health Authority.

(23) “Disability policy” means an insurance policy that provides benefits for losses due to a covered illness or disability.

(24) “Disclosure” means the release, transfer, provision of access to, or divulging in any other manner of information outside the entity holding the information.

(25) “Dual Eligible Special Needs Plan” means a Special Needs Plan that enrolls beneficiaries entitled to both Medicare and Medicaid.

(26) “Eligibility file” means a data set containing demographic information for each individual enrolled member eligible for medical benefits for one or more days of coverage at any time during a calendar month for an Oregon resident as defined in ORS 803.355, a non-Oregon resident who is a member of a PEBB or OEBB group health insurance plan, or services provided in Oregon.

(27) “Eligible employee” shall have the meaning given that term in ORS 743.730(12).

(28) “Employee” shall have the meaning given that term in ORS 654.005(4).

(29) “Employer” shall have the meaning given that term in ORS 654.005(5).

(30) “Encrypted identifier” means a code or other means of identification to allow individual patients or enrolled members to be tracked across data sets without revealing their identity.

(31) "Encryption" means a method by which the true value of data has been disguised in order to prevent the identification of individual patients or enrolled members and does not provide the means for recovering the true value of the data.

(32) “Enrolled member” means enrollee as defined in ORS 743.730(14).

(33) “Facility” means a health care facility as defined in ORS 442.015(16).

(34) “Genetic tests” shall have the meaning given that term in ORS 192.531(14).

(35) “Group health insurance” shall have the meaning given that term in ORS 743.522.

(36) “Health benefit plan” shall have the meaning given that term in ORS 743.730(19).

(37) “Health care” shall have the meaning given that term in ORS 192.519(3).

(38) “Health care provider” shall have the meaning given that term in ORS 192.519(5).

(39) “Health information” shall have the meaning given that term in ORS 192.519(6).

(40) “Healthcare claims data file” means electronic health information including medical claims files, medical eligibility files, pharmacy claims files, pharmacy eligibility files, and any other related information specified in this rule.

(41) “Healthcare Common Procedure Coding System(HCPCS)” means a medical code set, maintained by the United States Department of Health and Human Services, that identifies health care procedures, equipment, and supplies for claim submission purposes.

(42) “HIPAA” means Title II, Subtitle F of the Health Insurance Portability and Accountability Act of 1996, 42 USC 1320d, et seq. and the federal regulations adopted to implement the Act.

(43) “Hospital indemnity policy” means an insurance policy that provides benefits only for covered hospital stays.

(44) “Indirect personal identifier” means information relating to an individual patient or enrolled member that a person with appropriate knowledge of and experience with generally accepted statistical and scientific principles and methods could apply to render such information individually identifiable by using such information alone or in combination with other reasonably available information.

(45) “Individual”, when used in a list of required lines of business, means individual health benefit plans.

(46) “Individually identifiable health information” shall have the meaning given that term in ORS 192.519(8).

(47) “Insurance” shall have the meaning given that term in ORS 731.102.

(48) “Labor union” means any organization which is constituted for the purpose, in whole or in part, of collective bargaining or dealing with employers concerning grievances, terms or conditions of employment or of other mutual aid or protection in connection with employees.

(49) “Large group” means health benefit plans for employers with more than 50 employees.

(50) “Limited data set” means protected health information that excludes direct personal identifiers and is disclosed for research, program operations, or to a public health authority for public health purposes.

(51) “Long-term care insurance” shall have the meaning given that term in ORS 743.652(4).

(52) “Managed care organization”(MCO) means a prepaid managed care health services organization as defined in ORS 414.736.

(53) “Mandatory reporter” means any reporting entity defined as a mandatory reporter in OAR 409-025-0110.

(54) “Medicaid” means medical assistance provided under 42 U.S.C. section 1396a(section 1902 of the Social Security Act), as administered by the Division of Medical Assistance Programs.

(55) “Medicaid fee-for-service”(Medicaid FFS) means that portion of Medicaid where a health care provider is paid a fee for each covered health care service delivered to an eligible Medicaid patient.

(56) “Medical claims file” means a data set composed of health care service level remittance information for all adjudicated claims for each billed service including but not limited to member demographics, provider information, charge and payment information, and clinical diagnosis and procedure codes for an Oregon resident as defined in ORS 803.355, a non-Oregon resident who is a member of a PEBB or OEBB group health insurance plan, or services provided in Oregon.

(57) “Medical provider file” means a data set containing information about health care providers providing health care services, equipment, or supplies to enrolled members during the reporting period.

(58) “Medicare” means coverage under Part A, Part B, Part C, or Part D of Title XVIII of the Social Security Act, 42 U.S.C. 1395 et seq., as amended.

(59) “Medicare Modernization Act” means the Medicare Prescription Drug, Improvement, and Modernization Act of 2003(Public Law 108-173) and the federal regulations adopted to implement the Act.

(60) “OEBB” means the Oregon Educators Benefit Board.

(61) “OHPR” means the Office for Oregon Health Policy and Research.

(62) “OMIP” means the Oregon Medical Insurance Pool.

(63) “Patient” means any person in the data set who is the subject of the activities of the claim performed by the health care provider.

(64) “Paid amount” means the actual dollar amount paid for claims.

(65) “PEBB” means the Oregon Public Employees’ Benefit Board.

(66) “Person” shall have the meaning given that term in ORS 731.116.

(67) “Pharmacy benefit manager(PBM)” means a person or entity that performs pharmacy benefit management, including a person or entity in a contractual or employment relationship with a person or entity performing pharmacy benefit management for a health benefits plan.

(68) “Pharmacy claims file” means a data set containing service level remittance information from all adjudicated claims including, but not limited to, enrolled member demographics, provider information, charge and payment information, and national drug codes for an Oregon resident as defined in ORS 803.355, a non-Oregon resident who is a member of a PEBB or OEBB group health insurance plan, or services provided in Oregon.

(69) “Pharmacy eligibility file” means a data set containing demographic information for each individual enrolled member eligible for pharmacy benefits for one or more days of coverage at any time during a calendar month for an Oregon resident as defined in ORS 803.355, a non-Oregon resident who is a member of a PEBB or OEBB group health insurance plan, or services provided in Oregon.

(70) “Policy” shall have the meaning given that term in ORS 731.122.

(71) “Portability” means portability health benefit plans as defined in ORS 743.760.

(72) "Prepaid amount" means the fee for the service equivalent that would have been paid for a specific service if the service had not been capitated.

(73) “Premium” shall have the meaning given that term in ORS 743.730.

(74) “Principal investigator (PI)” means the person in charge of a research project that makes use of limited data sets. The PI is the custodian of the data and shall comply with all state and federal restrictions, limitations, and conditions of use associated with the data release.

(75) “Protected health information” shall have the meaning given that term in ORS 192.519(11).

(76) “Public health authority” means the Public Health Division of the Authority or local public health authority as defined in ORS 431.260(7).

(77) “Public health purposes” means the activities of a public health authority for the purpose of preventing or controlling disease, injury, or disability including, but not limited to, the reporting of disease, injury, vital events such as birth or death, and the conduct of public health surveillance, investigations, and interventions.

(78) “Public use data set” means a publicly available data set of de-identified health information containing only the data elements specified by OHPR for inclusion.

(79) “Registered entity” means any person required to register with DCBS under ORS 744.714.

(80) “Reporting entity” means:

(a) An insurer as defined in ORS 731.106 or fraternal benefit society as defined in ORS 748.106 required to have a certificate of authority to transact health insurance business in Oregon.

(b) A health care service contractor as defined in ORS 750.005 that issues medical insurance in Oregon.

(c) A third-party administrator required to obtain a license under ORS 744.702.

(d) A pharmacy benefit manager or fiscal intermediary, or other person that is by statute, contract, or agreement legally responsible for payment of a claim for a health care item or service.

(e) A prepaid managed care health services organization as defined in ORS 414.736.

(f) An insurer providing coverage funded under Part A, Part B, or Part D of Title XVIII of the Social Security Act, subject to approval by the United States Department of Health and Human Services.

(81) “Research” means a systematic investigation, including research development, testing and evaluation, designed to develop or contribute to generalized knowledge.

(82) “Self-insured plan” means any plan, program, contract, or any other arrangement under which one or more employers, unions, or other organizations provide health care services or benefits to their employees or members in this state, either directly or indirectly through a trust or third-party administrator.

(83) “Small employer health insurance” means health benefit plans for employers whose workforce consists of at least two but not more than 50 eligible employees.

(84) “Special Needs Plan” means a Medicare health benefit plan created by the Medicare Modernization Act that is specifically designed to provide targeted care to individuals with special needs.

(85) “Specific disease policy” means an insurance policy that provides benefits only for a loss due to a covered disease.

(86) “Strongly-encrypted” means an encryption method that uses a cryptographic key with a large number of random keyboard characters.

(87) “Subscriber” means the individual responsible for payment of premiums or whose employment is the basis for eligibility for membership in a health benefit plan.

(88) “Third-party administrator (TPA)” means any person who directly or indirectly solicits or effects coverage of, underwrites, collects charges or premiums from, or adjusts or settles claims on, residents of Oregon or residents of another state from offices in Oregon, in connection with life insurance or health insurance coverage; or any person or entity who must otherwise be licensed under ORS 744.702.

(89) “Transact insurance” shall have the meaning given that term in ORS 731.146.

(90) “Trust” means a fund established by:

(a) Two or more employers in the same or related industry; or

(b) One or more labor unions; or

(c) One or more employers and one or more labor unions; or

(d) An association as described in ORS 743.522(1)(b).

(91) “Vision policy” means a health benefits plan covering only vision health care.

(92) “Voluntary reporter” means any registered or reporting entity, other than a mandatory reporter, that voluntarily elects to comply with the reporting requirements in OAR 409-025-0100 to 409-025-0170.

Stat. Auth.: ORS 442.466
Stats. Implemented: ORS 442.464 & 442.466
Hist.: OHP 1-2010, f. 2-26-10, cert. ef. 3-1-10; OHP 4-2012, f. 5-23-12, cert. ef. 6-1-12; OHP 5-2012(Temp), f. 6-23-12, cert. ef. 6-1-12 thru 11-15-12; OHP 6-2012; f. 6-26-12, cert. ef. 7-9-12

409-025-0110

General Reporting Requirements

(1) Definition of “mandatory reporter”

(a) For carriers and licensed third-party administrators, OHPR shall identify mandatory reporters using information collected by DCBS including, but not limited to, data from the Health Insurance Member Enrollment Report.

(A) OHPR shall aggregate the most recent four quarters of data.

(B) OHPR shall calculate the mean total lives for each carrier and licensed third-party administrator.

(C) All carriers and licensed third-party administrators with calculated mean total lives of 5,000 or higher shall be mandatory reporters.

(b) All PBMs shall be mandatory reporters.

(c) All MCOs shall be mandatory reporters.

(d) All CCOs shall be mandatory reporters.

(e) All reporting entities with Dual Eligible Special Needs Plans in Oregon shall be mandatory reporters.

(2) Voluntary reporters may elect to participate by notifying the Administrator in writing.

(3) Mandatory and voluntary reporters shall submit healthcare claims data files for all required lines of business and shall not submit claims for any excluded lines of business. Required and excluded lines of business are specified in Schedule B.

(4) Mandatory and voluntary reporters shall comply with healthcare claims data file layout, format, and coding requirements in OAR 409-025-0120.

(5) Mandatory and voluntary reporters shall comply with healthcare claims data submission requirements in OAR 409-025-0130.

(6) Unless otherwise required by state or federal rules, regulations or statutes, mandatory and voluntary reporters shall not submit the following types of claims:

(a) Claims related to genetic tests; or

(b) Any claims subject to stricter disclosure limits imposed by state or federal rules, regulations, or statutes.

(7) OHPR shall provide written notification to all mandatory reporters subject to the reporting requirements of OAR 409-025-0100 to 409-025-0170.

(a) Beginning March 1, 2010 OHPR shall notify all mandatory reporters subject to the reporting requirements of OAR 409-025-0100 to 409-025-0170 during the calendar year 2010.

(b) By July 1, 2010 OHPR shall notify all mandatory reporters subject to the reporting requirements of OAR 409-025-0100 to 409-025-0170 for the calendar year 2011.

(c) Beginning January 1, 2011, OHPR shall notify by July 1 all mandatory reporters subject to the reporting requirements of OAR 409-025-0100 to 409-025-0170 for the following calendar year.

Stat. Auth.: ORS 442.466
Stats. Implemented: ORS 442.464 & 442.466
Hist.: OHP 1-2010, f. 2-26-10, cert. ef. 3-1-10; OHP 4-2012, f. 5-23-12, cert. ef. 6-1-12; OHP 5-2012(Temp), f. 6-23-12, cert. ef. 6-1-12 thru 11-15-12; OHP 6-2012; f. 6-26-12, cert. ef. 7-9-12

409-025-0120

Healthcare Claims Data File Layout, Format, and Coding Requirements

(1) Required healthcare claims data files shall include:

(a) Medical claims;

(b) Eligibility;

(c) Medical provider;

(d) Pharmacy claims; and

(e) Control totals.

(2) The medical claims file shall be submitted using the approved layout, format, and coding described in Appendix A.

(3) The eligibility file shall be submitted using the approved layout, format, and coding described in Appendix B.

(4) The medical provider file shall be submitted using the approved layout, format, and coding described in Appendix C.

(5) The pharmacy claims file shall be submitted using the approved layout, format, and coding described in Appendix D.

(6) The control totals file shall be submitted using the approved layout, format, and coding described in Appendix E.

(7) All data elements are required unless specified as optional or situational.

(8) All required healthcare claims data files shall be submitted as delimited ASCII files.

(9) Numeric data are positive integers unless otherwise specified.

(a) Negative values are allowed for revenue codes, quantities, charges, payment, co-payment, co-insurance, deductible, and prepaid amount.

(b) Negative values shall be preceded by a minus sign.

(10) OHPR shall convene a technical advisory group to advise OHPR and associated contractors on submission specifications including but not limited to Appendices A-E, Schedule A and any additional data submission requirements. The advisory group shall include, but not be limited to representatives from:

(a) Carriers;

(b) TPAs;

(c) PBMs;

(d) CCOs; and

(e) Other stakeholders and interested parties.

(11) All data files shall pass edit checks and validations implemented by OHPR or the data vendor.

Stat. Auth.: ORS 442.466
Stats. Implemented: ORS 442.464 & 442.466
Hist.: OHP 1-2010, f. 2-26-10, cert. ef. 3-1-10; OHP 4-2012, f. 5-23-12, cert. ef. 6-1-12

409-025-0130

Healthcare Claims Data Submission Requirements

(1) OHPR shall notify mandatory reporters of the submission start date for program initiation in 2010, which shall occur when the following conditions are met:

(a) Final versions of Appendices A-C have been published on the OHPR web site for at least 120 days; and

(b) OHPR is satisfied that the data vendor is prepared to test transmission of healthcare claims data files from mandatory reporters.

(2) Mandatory reporters shall submit healthcare claims data files as specified in Schedule A. Voluntary reporters may consult with OHPR to submit healthcare claims data files on an alternative schedule.

(3) Mandatory and voluntary reporters shall submit healthcare claims data files directly to the data vendor unless otherwise specified by OHPR.

(4) Mandatory and voluntary reporters shall transmit healthcare claims data files using one of the following approved processes:

(a) Secure file transfer protocol (SFTP) including separate strong encryption of data files prior to SFTP transmission; or

(b) Any process incorporating strong encryption that is approved in writing by both OHPR and the data vendor.

Stat. Auth.: ORS 442.466
Stats. Implemented: ORS 442.464 & 442.466
Hist.: OHP 1-2010, f. 2-26-10, cert. ef. 3-1-10; OHP 4-2012, f. 5-23-12, cert. ef. 6-1-12

409-025-0140

Waivers and Exceptions

(1) OHPR may grant a waiver of the reporting requirements.

(a) A mandatory reporter requesting a waiver of the reporting requirements shall submit a Waiver of Reporting Requirements Form (APAC-1) to OHPR. The request must be received by OHPR 60 calendar days prior to the applicable reporting deadline.

(A) OHPR shall approve a request for a waiver from a mandatory reporter when the mandatory reporter is already subject to substantially similar claims data reporting requirements under a contract with the Authority. The waiver shall remain in force so long as the mandatory reporter is in compliance with its claims data reporting requirements under its contract with the Authority. A waiver approved under this section shall automatically expire as of the date the mandatory reporter is no longer required to submit substantially similar claims data under its contract with the Authority.

(B) A mandatory reporter’s lines of business that are not under a contract with the Authority shall not be covered by a waiver approved under OAR-409-025-0140(1)(a)(A).

(C) If OHPR does not approve a request for a waiver from a mandatory reporter the written notification from OHPR shall include the reason(s) for the denial.

(b) OHPR shall approve or deny the request and provide written notification to the requester within 30 calendar days of receipt of the request.

(c) If OHPR denies the waiver, the requester may appeal the denial by requesting a contested case hearing. The appeal must be filed within 30 business days of the denial. The appeal process is conducted pursuant to ORS chapter 183 and the Attorney General’s Uniform and Model rules of Procedure for the Office of Administrative Hearings, OAR 137-003-0501 to 137-003-0700. The requester shall have the burden to prove a compelling need for the waiver.

(d) The waiver shall expire at the end of the calendar year unless otherwise specified by OHPR.

(2) OHPR may grant an exception to healthcare claims data file layout, format, and coding requirements, and submission requirements:

(a) A mandatory reporter requesting an exception for healthcare claims data file layout, format, or coding requirements shall submit a Healthcare Claims Data File Format Exception Form (APAC-2) to OHPR. The request must be received by OHPR prior to the applicable reporting deadline.

(b) The mandatory reporter requesting an exception to healthcare claims data submission requirements shall submit a Healthcare Claims Data File Submission Requirement Exception Form (APAC-3) to OHPR. The request must be received by OHPR prior to the applicable reporting deadline.

(c) OHPR shall approve or deny the request and provide written notification to the requester within 30 calendar days of receipt of the request.

(d) If OHPR denies the waiver, the requester may appeal the denial by requesting a contested case hearing. The appeal must be filed within 30 business days of the denial. The appeal process is conducted pursuant to ORS chapter 183 and the Attorney General’s Uniform and Model rules of Procedure for the Office of Administrative Hearings, OAR 137-003-0501 to 137-003-0700. The requester shall have the burden to prove a compelling need for the waiver.

(e) The exception shall expire at the end of the calendar year unless otherwise specified by OHPR.

[ED. NOTE: Forms referenced are available from the agency]

Stat. Auth.: ORS 442.466
Stats. Implemented: ORS 442.464 & 442.466
Hist.: OHP 1-2010, f. 2-26-10, cert. ef. 3-1-10

409-025-0150

Compliance and Enforcement

Penalties for failure to comply shall be enforced by OHPR.

(1) Unless approved by a waiver or exception, failure to comply with general reporting requirements shall include but is not limited to:

(a) Failure to submit healthcare claims data files for a required line of business; and

(b) Submitting health information for an excluded line of business.

(2) Unless approved by a waiver or exception, failure to comply with healthcare claims data file requirements shall include but is not limited to:

(a) Submitting a healthcare claims data file in an unapproved layout;

(b) Submitting a data element in an unapproved format;

(c) Submitting a data element with unapproved coding; or

(d) Failure to submit a required data element.

(3) Unless approved by a waiver or exception, failure to comply with healthcare claims data submission requirements shall include but is not limited to:

(a) Failure to submit test files as specified by the data vendor;

(b) Submitting healthcare claims data files later than 30 days after the end of the month;

(c) Rejection of a healthcare claims data file by the data vendor that is not cured by the submitter; or

(d) Transmitting healthcare claims data files using an unapproved process.

(4) OHPR shall provide mandatory reporters written notification of each failure to comply.

(5) OHPR may impose fines of up to $500 per day for each failure to comply that is not cured within 30 calendar days of written notification.

(6) If a mandatory reporter has made documented efforts to comply with OAR 409-025-0100 to 409-025-0170, the Administrator may consider this a mitigating factor.

Stat. Auth.: ORS 442.466 & 442.993
Stats. Implemented: ORS 442.464, 442.466 & 442.993
Hist.: OHP 1-2010, f. 2-26-10, cert. ef. 3-1-10

409-025-0160

Limited and Public Use Data Sets

(1) Public use data sets.

(a) OHPR shall maintain an approved list of data elements, described in Appendix F, that may be included in APAC public use data sets. Appendix F shall comply with applicable Authority policies and state and federal rules, regulations, and statutes.

(b) Requesters seeking access to data from the APAC Public Use Data Sets shall complete an Application for Public Use Data Sets Form (APAC-4) and comply with the application procedures for public use data sets outlined on the APAC website.

(c) OHPR shall approve or deny the completed request and provide written notification to the requester within 30 calendar days of receipt of the request.

(d) OHPR shall deny the completed request for reasons which include, but are not limited to:

(A) Requester or any person who will have access to the data has previously violated a data use agreement with the Authority.

(B) The Administrator finds that the general purpose of the study does not serve the public interest.

(C) The Administrator finds that the specific details of the request do not sufficiently explain the proposed use.

(D) The Administrator finds that the specific details of the request violate any state or federal rule, regulation, or statute.

(E) The Administrator finds that the specific details of the request violate form APAC-4, Section 3: Data Use Agreement.

(F) The Administrator finds that the administrative, technical, and physical safeguards specified in the request do not sufficiently protect the data set.

(G) Full payment is not included with the application.

(e) If OHPR denies the Application for Public Use Data Sets:

(A) OHPR shall provide written notification stating the reason for the denial; and

(B) The requester may appeal the denial by requesting a contested case hearing. The appeal must be filed within 30 business days of the denial. The appeal process is conducted pursuant to ORS chapter 183 and the Attorney General’s Uniform and Model Rules of Procedure, OAR 137-003-0501 to 137-003-0700. The requester shall have the burden to prove that OHPR unreasonably denied the application.

(C) The public use files may not be used to identify any individual, including but not limited to patients, physicians, and other health care providers. The requestor may not use outside information to attempt to ascertain the identity of particular individuals who are the subject of public use files.

(2) Limited data sets.

(a) OHPR shall maintain an approved list of data elements, described in Appendix G, that may be included in APAC limited data sets.

(b) APAC limited data sets may be disclosed for research or to a public health authority for public health purposes.

(c) Researchers seeking access to the APAC Limited Data Sets shall complete an Application for Limited Data Sets Form (APAC-5) and comply with the application procedures for limited data sets outlined on the APAC website.

(d) OHPR shall review all applications for completeness and provide requesters written notification of completeness within 30 calendar days of receipt of the request.

(e) If OHPR determines that the application is incomplete, the requester shall have 30 calendar days from notification of incompleteness to complete the application. Incomplete applications that are not completed shall be discarded without further notification to the requester.

(f) Completed applications shall be made available for public inspection and written comment for no fewer than 14 days.

(g) OHPR shall convene a Privacy and Security Advisory Board to evaluate completed applications for limited data sets.

(A) The Privacy and Security Advisory Board shall include:

(i) Authority’s privacy officer or designee;

(ii) One representative of the Division of Medical Assistance Programs;

(iii) One representative of the Addictions and Mental Health Division;

(iv) One representative of the Public Health Division;

(v) One representative of the Director’s Office;

(vi) One representative of an insurer licensed to transact health insurance in Oregon;

(vii) One representative of a Coordinated Care Organization;

(viii) One representative of a hospital;

(ix) One representative of an ambulatory clinic;

(x) One academic researcher;

(xi) One other interested person not represented above; and

(xii) One non-voting chair, appointed by the Administrator.

(B) OHPR may accept nominations for and make appointments to the Privacy and Security Advisory Board.

(C) The Privacy and Security Advisory Board’s review shall include, but is not limited to:

(i) Whether submitted IRB documentation is sufficient.

(ii) Whether the proposed disclosure serves the public interest.

(iii) Whether the proposed disclosure supports the mission and aims of the Authority.

(iv) Whether the proposed privacy and security protections are sufficient.

(v) Whether additional clarification is needed to complete the review.

(vi) Public comments about the completed application.

(D) When reviewing applications for limited data sets, the Privacy and Security Advisory Board may request any expert testimony that it deems necessary and appropriate.

(h) OHPR shall publish a Privacy and Security Advisory Board meeting schedule on its website and periodically update the number of completed applications scheduled to be reviewed during each meeting.

(i) OHPR shall schedule completed applications for limited data sets for review by the Privacy and Security Advisory Board on a first-come-first-served basis.

(j) The Privacy and Security Advisory Board shall recommend that OHPR approve the application, deny the application, defer action pending expert testimony, or defer action pending clarification from the requester.

(k) OHPR shall accept or reject the Privacy and Security Advisory Board’s recommendation and notify the requester within ten business days of the review.

(l) OHPR shall deny a completed application for reasons which include, but are not limited to:

(A) Requester or any person who will have access to the data has previously violated a data use agreement with the Authority.

(B) Full payment is not included with the application.

(m) If the Privacy and Security Advisory Board requests clarification, the requester shall have 30 calendar days to provide the requested information to OHPR. After 30 calendar days, applications with incomplete requests for clarification shall be discarded without further notification to the requester.

(n) Upon receipt of the requested clarification OHPR shall schedule re-evaluation with the Privacy and Security Advisory Board on a first-come-first-served basis.

(o) If OHPR denies the application:

(A) OHPR shall provide written notification stating the reason for the denial.

(B) The requester may appeal the denial by requesting a contested case hearing. The appeal must be filed within 30 business days of the denial. The appeal process is conducted pursuant to ORS Chapter 183 and the Attorney General’s Uniform and Model rules of Procedure, OAR 137-003-0501 to 137-003-0700. The requester shall have the burden to prove that OHPR unreasonably denied the application.

Stat. Auth.: ORS 442.466
Stats. Implemented: ORS 442.464 & 442.466
Hist.: OHP 1-2010, f. 2-26-10, cert. ef. 3-1-10; OHP 4-2012, f. 5-23-12, cert. ef. 6-1-12; OHP 2-2013, f. 1-24-13, cert. ef. 2-1-13

409-025-0170

Public Disclosure

(1) OHPR shall convene an advisory group to provide recommendations for developing a comprehensive health information system no later than June 1, 2010. The advisory group shall include, but not be limited to representatives from:

(a) Carriers;

(b) TPAs;

(c) PBMs;

(d) MCOs; and

(e) Other stakeholders and interested parties.

(2) OHPR, applicable contractors, and other entities inside the Authority shall perform data analyses and publish data and reports that serve the public’s interest. This may include, but is not limited to:

(a) Comparing healthcare cost and quality;

(b) Assessing health care utilization;

(c) Assessing the capacity and distribution of healthcare resources;

(d) Assessing health care purchasing decisions;

(e) Assessing the effectiveness of public health programs; or

(f) Assessing disparities in health care delivery and outcomes.

(3) OHPR may convene advisory groups to advise OHPR on topics related to the All-Payer Healthcare Claims Data Reporting Program. The advisory groups shall include, but not be limited to representatives from:

(a) Carriers;

(b) TPAs;

(c) PBMs;

(d) MCOs; and

(e) Other stakeholders and interested parties.

Stat. Auth.: ORS 442.466
Stats. Implemented: ORS 442.464 & 442.466
Hist.: OHP 1-2010, f. 2-26-10, cert. ef. 3-1-10

The official copy of an Oregon Administrative Rule is contained in the Administrative Order filed at the Archives Division, 800 Summer St. NE, Salem, Oregon 97310. Any discrepancies with the published version are satisfied in favor of the Administrative Order. The Oregon Administrative Rules and the Oregon Bulletin are copyrighted by the Oregon Secretary of State. Terms and Conditions of Use

Oregon Secretary of State • 136 State Capitol • Salem, OR 97310-0722
Phone: (503) 986-1523 • Fax: (503) 986-1616 • oregon.sos@state.or.us

© 2013 State of Oregon All Rights Reserved​