7.3 Patient Confidentiality: Oregon Rules, HIPAA, Part 2 & PDMP Privacy
Key Takeaways
Oregon licensees may disclose patient information without consent only to the Board, to providers when a pharmacist authorizes it for the patient's health, as law authorizes or requires, as confidentiality laws permit, or to the patient.
Under OAR 855-104-0015, an Oregon licensee may not access or obtain patient information except for patient care, even without disclosing it.
Oregon pharmacies must provide patients' records within 30 days and may not deny copies because of inability to pay.
HIPAA lets pharmacies disclose PHI for treatment, payment and operations, requires notice of a breach within 60 days, and in 2025 a court vacated most of its 2024 reproductive-health amendments.
Oregon PDMP data is confidential, may not be used commercially, and reaches law enforcement only through a court order based on probable cause.
Why this matters
Area 2.5 includes "protecting patient and health record confidentiality." Oregon pharmacists must satisfy three layers: the Board's universal confidentiality rule (OAR 855-104-0015), HIPAA, and special-category rules such as 42 CFR Part 2 for substance use disorder records and the PDMP statute. Exam items typically ask whether a disclosure is allowed and to whom.
Oregon's confidentiality rule (OAR 855-104-0015)
A licensee or registrant who obtains patient information may not disclose it to a third party without the patient's consent, except:
- To the Board.
- To a practitioner, pharmacist, intern, technician or registrant, if a pharmacist authorizes the disclosure and it is necessary to protect the patient's health or well-being.
- To a third party when disclosure is authorized or required by law.
- As permitted by federal and state confidentiality laws (HIPAA and Oregon's health-information statutes, ORS 192.553–.581).
- To the patient, or to persons the patient authorizes.
The rule also bars accessing or obtaining patient information except for patient care (or one of those exceptions). Looking up a neighbor's or ex-spouse's profile is a violation even if nothing is disclosed. Pharmacists, interns and technicians each have a parallel confidentiality rule (OAR 855-115-0110, 855-120-0110, 855-125-0110).
Patients' access to their pharmacy records (OAR 855-104-0050)
- Licensees and registrants must make health information in the pharmacy record available to the patient or patient's representative on request, for inspection and copying.
- A reasonable cost may be charged, but a patient may not be denied summaries or copies because of inability to pay.
- Requests must be met within a reasonable time, not to exceed 30 days.
- Some information may be withheld. Examples are information obtained in confidence from non-health-care sources, psychotherapy notes, information compiled for legal proceedings, and information federal rules allow to be withheld.
HIPAA essentials for pharmacies
| Topic | Rule |
|---|---|
| Covered entity | Pharmacies that bill electronically are covered entities. Their vendors with PHI access are business associates and need business associate agreements |
| Treatment, payment, operations (TPO) | PHI may be used and disclosed for TPO without authorization. Pharmacist-to-prescriber communication about therapy is treatment |
| Minimum necessary | Applies to most disclosures except those for treatment and those to the patient |
| Notice of Privacy Practices | Given at first service delivery; a good-faith effort to get acknowledgment |
| Patient rights | Access (federal HIPAA allows up to 30 days, extendable once by 30 days), amendment, accounting of disclosures, restrictions (including self-pay restrictions on disclosures to health plans), confidential communications |
| Family and caregivers | A pharmacist may use professional judgment to let a family member or friend pick up filled prescriptions |
| Breach notification | Notify affected individuals without unreasonable delay, and no later than 60 days after discovery |
A June 18, 2025 federal court decision (Purl v. HHS) vacated most of the 2024 HIPAA amendments on reproductive health care privacy. Separately, updated Notice of Privacy Practices requirements tied to 42 CFR Part 2 took effect February 16, 2026.
Substance use disorder records (42 CFR Part 2)
Records from a federally assisted SUD program have extra protection. Under the 2024 final rule, with compliance due February 16, 2026:
- Patients may sign a single consent for all future treatment, payment and operations.
- HIPAA covered entities that receive records under that consent may redisclose them as HIPAA permits, except in proceedings against the patient.
- A subpoena alone still does not authorize disclosure. A court order meeting Part 2 standards is required.
Oregon's HPSP statute and the PDMP statute expressly incorporate Part 2 and ORS 179.505.
PDMP confidentiality (ORS 431A.865)
PDMP data is protected health information and is not a public record. Pharmacists may access it only to evaluate or provide treatment for their patient. They may share it with other providers involved in the patient's care for care coordination. The data may not be used commercially. Law enforcement may obtain it only through a valid court order based on probable cause. Improper disclosure can bring civil damages and an Attorney General civil penalty of up to $10,000 per violation (ORS 431A.900).
Important
In Oregon, access without a patient-care purpose is itself a violation (OAR 855-104-0015(3)). A technician who looks up a celebrity's prescription history commits a Board violation and a HIPAA violation, even if they never tell anyone.
Disclosures to law enforcement and others
- Law enforcement: HIPAA permits limited disclosures in response to a court order, warrant or qualifying administrative request, and in other narrow cases. Oregon's PDMP requires a court order. Precursor (pseudoephedrine) logs are available to law enforcement through a lawful subpoena accepted by the Board (ORS 475.230(5)(c)). Acceptable subpoenas are addressed in OAR 855-080-0029.
- The Board: disclosure to the Board is always allowed (OAR 855-104-0015(2)(a)).
- Public health reporting: required disclosures, such as ALERT IIS, communicable disease reporting, Death with Dignity reporting and the PDMP, are "required by law."
Exam scenario
A detective calls a Portland pharmacy and asks for a suspect's controlled substance fill history "for an active investigation," with no paperwork. The pharmacist should decline. A phone request is not an exception under OAR 855-104-0015 or HIPAA without proper legal process. The pharmacist may refer the detective to the appropriate legal process, such as a warrant, a court order, or a PDMP request through a court order based on probable cause. The pharmacist documents the request under the pharmacy's privacy policies.
A pharmacy technician in Oregon views an ex-partner's medication profile out of curiosity but tells no one. What is the legal status of this conduct?
Lawful, because nothing was disclosed
Lawful if the technician works at that pharmacy
A violation only if the profile contains controlled substances
A violation; OAR 855-104-0015 prohibits accessing or obtaining patient information except for patient care, and HIPAA prohibits impermissible uses
Within what period must an Oregon pharmacy comply with a patient's request for copies of their pharmacy records under OAR 855-104-0050?
Within a reasonable time not to exceed 30 days
Within 24 hours
Within 10 business days
Within 90 days
Which disclosure of patient information is permitted by OAR 855-104-0015 without the patient's consent?
Telling the patient's employer that the patient fills antidepressants
Giving a marketing company a list of patients on statins
Sharing information with another practitioner when a pharmacist authorizes it and it is necessary to protect the patient's health or well-being
Answering a detective's phone request for a fill history
Sections you finish are checked off in the contents.