Oregon Revised Statutes Chapter 442 § 442.370 — and 442.400 to 442.463. The authority, in consultation with interested

and 442.400 to 442.463. The authority, in consultation with interested stakeholders, shall: (a) Formulate the data sets that will be included in the system; (b) Establish the criteria and procedures for the development of limited use data sets; (c) Establish the criteria and procedures to ensure that limited use data sets are accessible and compliant with federal and state privacy laws; and (d) Establish a time frame for the creation of the comprehensive health care information system. (8) Information disclosed through the comprehensive health care information system described in subsection (7) of this section: (a) Shall be available, when disclosed in a form and manner that ensures the privacy and security of personal health information as required by state and federal laws, as a resource to researchers, insurers, employers, providers, purchasers of health care and state agencies to allow for continuous review of health care utilization, expenditures and performance in this state; (b) Shall be available to Oregon programs for quality in health care for use in improving health care in Oregon, subject to rules prescribed by the authority conforming to state and federal privacy laws or limiting access to limited use data sets; (c) Shall be presented to allow for comparisons of geographic, demographic and economic factors and institutional size; and (d) May not disclose trade secrets of reporting entities or self-funded, employer-sponsored health insurance plans regulated under the Employee Retirement Income Security Act of 1974, as codified and amended at 29 U.S.C. 1001, et seq., that report health care data voluntarily. (9) The collection, storage and release of health care data and other information under this section is subject to the requirements of the federal Health Insurance Portability and Accountability Act. (10)(a) Notwithstanding subsection (9) of this section, in addition to the comprehensive health care information system described in subsection (7) of this section, the Department of Consumer and Business Services shall be allowed to access, use and disclose data collected under this section by certifying in writing that the data will be used only to carry out the department’s duties. (b) Personally identifiable information disclosed to the department under paragraph (a) of this subsection, including a consumer’s name, address, telephone number or electronic mail address, is confidential and not subject to further disclosure under ORS 192.311 to 192.478. (11) The authority may impose a charge for information disclosed to researchers, insurers, employers, providers and purchasers of health care under subsection (8) of this section in an amount necessary to cover the authority’s actual costs for collecting and releasing the information that is requested. [Formerly 442.466; 2021 c.205 §4; 2023 c.584 §1] Note: See note under 442.372. HEALTH CARE COSTS (Health Care Cost Growth Target Program)