Oregon Supreme Court Decides Pivotal HIPAA Issue

Brian Annulis

Managing Director

Aegis Compliance & Ethics Center, LLP

Oregon Supreme Court Decides Pivotal HIPAA Issue

On October 19, 2017, the Oregon Supreme Court issued an opinion in Oregon Health Science University vs. Oregonian Publishing Company, LLC.  The case pitted Oregon Health Science University (“OHSU”), a public corporation and HIPAA covered entity against The Oregonian, a newspaper.


The Oregonian sought to obtain copies of certain records from OHSU under the Oregon Public Records Law (“OPRL”).  As a public/state entity, OHSU (like other Oregon public entities and agencies) is subject to the OPRL.  By analogy, the OPRL (and other state/open record laws), is like the federal Freedom of Information Act (“FOIA”).  Such state and federal laws are intended to ensure open/public access to records maintained by state-sponsored or supported agencies.  However, public access to records maintained by federal/state agencies is not unfettered. There are exceptions/exemptions intended to safeguard the privacy of certain information collected by federal and state agencies; thereby, balancing the need for public transparency with safeguarding personal and confidential information.

Under Oregon law, if you intend to sue OHSU (or any other public entity) for a tort, you are required to file a tort claim notice.  The notice requires the identification of certain claim-specific information.  Tort claim notices could be filed against OHSU (a public health and research university) by any number of individuals, including patients and students, for tort injuries those individuals are alleged to have suffered.

Deviation from Tort Claim Notices

In this case, The Oregonian did not seek copies of the actual tort claims notices but rather claimant information derived from those notices, including the claimant’s name and the claimant’s attorney’s name.  OHSU objected.  OHSU argued that the disclosure of such information would result in the unauthorized disclosure of patient and student information otherwise protected from disclosure by federal (HIPAA, FERPA) and state law.  The Oregonian persisted and won the early rounds of the fight.  The Multnomath County, Oregon District Attorney sided with The Oregonian.  OHSU appealed. The Circuit Court also sided with The Oregonian.  OHSU appealed again.  Finally, the Court of Appeals sided with OHSU.  This time, The Oregonian appealed to the Oregon Supreme Court for final resolution of the dispute.

The Oregon Supreme Court did not resolve the issue regarding The Oregonian’s request for information derived from student tort claim notices (it remanded the case to the Circuit Court for further development of that issue); however, it did finally resolve the issue regarding the requested information derived from tort claim notices filed by patients.  The critical issue came down to whether disclosure of the requested information was “required” by the OPRL and, therefore, a “permitted” disclosure under the HIPAA Privacy Rule (45 CFR 164.512(a)).  The Court concluded that the requested information was not required to be disclosed under the OPRL and, in fact, was exempt from disclosure under the OPRL and other Oregon state laws.   As such, OHSU was not permitted to disclose the information under HIPAA without patient authorization.

Importance of HIPAA

The case illustrates the continued importance of HIPAA covered entities (and business associates) ensuring that they are diligent in their efforts to safeguard protected health information and not disclose such information unless there is a credible basis to do so under the HIPAA Privacy Rule.


Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )


Connecting to %s