8.2 Oregon PDMP: Reporting Within 72 Hours, Covered Drugs, Access & Confidentiality

Why this matters

The blueprint calls out "requirements for reporting to PMP and accessing PMP data." Oregon's Prescription Drug Monitoring Program (PDMP) is run by the Oregon Health Authority under ORS 431A.855–431A.900 and OAR 333-023. Exam items test what is reported, how fast, what is excluded, whether pharmacists must query it, and how data may be shared.

What is reported (ORS 431A.855)

Pharmacies licensed by the Board report prescriptions they dispense for:

1. Schedule II through V controlled substances, as modified by Board rule.
2. Gabapentin.
3. Other drugs OHA identifies by rule.

Excluded from the PDMP:

• Short-acting opioid antagonists such as naloxone (ORS 431A.855(4)).
• Pseudoephedrine and ephedrine, which are tracked through the national electronic precursor system, not the PDMP.
• Drugs administered directly to a patient.
• Death with Dignity dispensing (ORS 431A.860(2)).
• Pharmacies in institutions as defined in ORS 179.010 (ORS 431A.860(5)).

Deadline and data elements (ORS 431A.860)

A pharmacy must report electronically not later than 72 hours after dispensing. The report includes:

• Patient name, address, phone, date of birth and sex. For veterinary prescriptions, the animal's species, name and sex.
• The dispensing pharmacy and date dispensed.
• The prescriber and date prescribed.
• The NDC, the prescription number, the quantity, the days' supply, and the refills authorized and refill number.
• The diagnosis code and reason for the prescription, as reported.

OHA may grant a waiver from electronic reporting for good cause, including financial hardship. The waiver sets the alternate format and frequency. Social Security numbers may not be collected.

Patient notice

OHA rules (OAR 333-023-0815) require pharmacies to notify each patient receiving a Schedule II–V drug, before or when it is dispensed, that the prescription will be entered into the PDMP. They use OHA's PDMP notice language. The Board's self-inspection form checks this.

Access and use (ORS 431A.865)

• Pharmacists and practitioners may get PDMP information by certifying that it is for evaluating or providing treatment to their patient. A pharmacist may authorize staff to access the data on their behalf, and remains responsible for the staff member's use or misuse.
• Access may also come through an integrated health IT system, such as the PDMP integration in pharmacy and EHR software, if OHA's privacy and security criteria are met.
• Providers with access may discuss or share PDMP information with other providers involved in the patient's care for care coordination (ORS 431A.865(3)(g)).
• Other permitted recipients include medical, dental and pharmacy directors (for oversight), the Chief Medical Examiner, health professional regulatory boards (with written certification), and Medicaid program directors. Law enforcement may receive data only under a valid court order based on probable cause in an authorized drug-related investigation.
• Veterinarians may not receive PDMP information.
• Patients may get their own PDMP record free within 10 business days, and may request correction. OHA must act within 10 business days.
• Patient-identifying information is removed no later than three years after entry.

Is a PDMP query mandatory?

No. ORS 431A.865(8) states that nothing in the PDMP law requires a pharmacist or practitioner to obtain PDMP information. A pharmacist may not be held liable in a civil action for querying or for not querying. Separately, a pharmacist may not refuse a valid prescription solely because PDMP data is unavailable at that moment (ORS 431A.870). Practitioners must register with the PDMP electronic system (ORS 431A.877). In practice, querying the PDMP is the standard way to resolve red flags and support corresponding responsibility (section 5.5).

Confidentiality, liability and penalties

PDMP information is protected health information and not a public record. It may not be used to evaluate a practitioner's professional practice except by a licensing board, and may not be used for any commercial purpose. A person injured by a violation may recover $1,000 or actual damages, whichever is greater. People who report or use the data are immune unless they act with malice, criminal intent, gross negligence, recklessness or willful intent. The Attorney General may impose a civil penalty of up to $10,000 per violation, and each improper release counts as a separate violation (ORS 431A.900). OHA reports misuse by a pharmacist to the Board (ORS 431A.875). Pharmacists pay a $70 PDMP fee with each biennial renewal.

Exam scenario

A community pharmacy dispenses, on Monday at 4 p.m.:

• Pregabalin (CV).
• Gabapentin.
• Naloxone nasal spray.
• Hydrocodone/acetaminophen (CII).

It also sells pseudoephedrine at the counter. The pharmacy must report the pregabalin, gabapentin and hydrocodone dispensings by Thursday at 4 p.m. (72 hours). It does not report the naloxone or the pseudoephedrine. The pseudoephedrine goes into the national precursor tracking system before the sale. Each controlled-substance patient gets OHA's PDMP notice.