Oregon Administrative Rules
Chapter 836 - DEPARTMENT OF CONSUMER AND BUSINESS SERVICES, INSURANCE REGULATION
Division 80 - TRADE PRACTICES
Section 836-080-0665 - Authorization

(1) Except as provided in OAR 836-080-0670 and 836-080-0675, a licensee or insurance-support organization may not disclose any personal or privileged information about an individual collected or received in connection with an insurance transaction unless the disclosure is with the written authorization of the individual, and:

(2) A licensee or insurance-support organization may not use as its disclosure authorization form in connection with health insurance transactions a form or statement that authorizes the disclosure of personal or privileged information about an individual to the licensee or insurance-support organization unless the form or statement is clear and conspicuous, and contains all of the following:

(3) An authorization may not remain valid for more than 24 months.

(4) An individual who is the subject of personal information may revoke an authorization provided pursuant to this rule at any time, subject to the rights of any individual who acted in reliance on the authorization prior to notice of the revocation.

(5) A licensee shall retain the authorization of an individual or a copy thereof in the record of the individual who is the subject of the personal information.

(6) This rule does not authorize the disclosure of personal or privileged information that is also individually identifiable health information when disclosure of the individually identifiable health information is prohibited or is otherwise regulated under the federal Health Insurance Portability and Accountability Act of 1996 (P.L. 104-191).

(7) A licensee is not required to comply with this rule with respect to a disclosure of personal information for which the licensee has obtained an authorization under the federal Health Insurance Portability and Accountability Act of 1996 (P.L. 104-191).