Health record rights in Oregon: what state law adds
In Oregon, as of October 3, 2026, your OK is needed before at least some businesses outside HIPAA share your health data; you get a copy of your record faster than HIPAA requires, and free in some cases; we found no law on the health information exchange; reproductive health, mental health, HIV and genetic records each have a specific confidentiality rule; you can sue over misuse of your records; breach notices must cover medical and health insurance information; and no rule we look for on AI in care is in force. Each answer below quotes, dates and links the law. There is no state total and no state rank.
Laws read · page updated
Not legal advice. This records what the law said on the date we read it. Laws and court orders change. Read the law itself, or ask a lawyer, before you rely on it. State laws add to the federal floor. The national score rates federal law and national infrastructure and does not change with these state profiles.
Can you sue if your records are misused?Yes. You can sue over unlawful collection, use or sharing of medical records or health data in general. Same answer in 11 of the 50 states, counting this one.
Federal law, mainly HIPAA, applies in every state; our US page explains it in plain English. Each answer below says what this state adds on top, with the law's name, citation, effective date, the words that matter and a link to the official page.
Do apps and wearables need your OK before sharing health data?
Federal floor: HIPAA does not cover most apps, wearables, websites or data brokers.
Yes, at least for some businesses. A law in force requires your OK before they use or share your health data (opt-in).
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Oregon Consumer Privacy Act (2023 c.369, operative July 1, 2024) requires consent to process sensitive data, which includes mental or physical condition or diagnosis. No dedicated consumer health data law was found in ORS chapter 646A.
Oregon Consumer Privacy Act: duties of controller; prohibitions. ORS 646A.578(2)(b)
In force · effective · quote not yet matched word for word to our stored copy of the page · read October 3, 2026 · source(oregonlegislature.gov)
Process sensitive data about a consumer without first obtaining the consumer’s consent or, if the controller knows the consumer is a child, without processing the sensitive data in accordance with the Children’s Online Privacy Protection Act of 1998
Who it binds, in our words: apply to any person that conducts business in this state, or that provides products or services to residents of this state, and that during a calendar year, controls or processes: (A) The personal data of 100,000 or more consumers
Oregon Consumer Privacy Act: definition of sensitive data. ORS 646A.570(18)(a)
In force · effective · quote not yet matched word for word to our stored copy of the page · read October 3, 2026 · source(oregonlegislature.gov)
Reveals a consumer’s racial or ethnic background, national origin, religious beliefs, mental or physical condition or diagnosis, sexual orientation, status as transgender or nonbinary
Who it binds, in our words: The personal data of 25,000 or more consumers, while deriving 25 percent or more of the person’s annual gross revenue from selling personal data.
Oregon Consumer Privacy Act: scope and exclusions (HIPAA protected health information excluded). ORS 646A.572(2)(b)
In force · effective · quote not yet matched word for word to our stored copy of the page · read October 3, 2026 · source(oregonlegislature.gov)
Protected health information that a covered entity or business associate processes in accordance with, or documents that a covered entity or business associate creates for the purpose of complying with, the Health Insurance Portability and Accountability Act of 1996
Who it binds, in our words: Exclusion from ORS 646A.570 to 646A.589. Public bodies and Oregon Health and Science University are also excluded.
Second check by a separate agent: confirmed.
Do you get a copy faster or free in some cases?
Federal floor: HIPAA gives the provider 30 days, plus one 30-day extension, and allows a cost-based fee. We also count the federal information blocking rule (45 CFR Part 171).
Yes, both. A deadline shorter than 30 days, and a free copy in at least one case.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Free copy for a Social Security disability appeal goes beyond the federal floor. A 5 working day deadline binds public providers only (ORS 179.505). The 2007 per-page cap is recorded as a fact.
Deadline in the law: 5 days.
Free copy: One free copy of health information for an individual appealing a denial of Social Security disability benefits, paper or electronic (ORS 192.576). Binds covered entities.
Fee rule: ORS 192.563: "No more than $30 for copying 10 or fewer pages of written material, no more than 50 cents per page for pages 11 through 50 and no more than 25 cents for each additional page". Also a $5 bonus if mailed within seven business days, plus postage and summary costs. Per-page cap, not counted.
Fee rule: ORS 192.576(3): a fee under ORS 192.563 may be charged when the request is by someone other than the individual or personal representative, or after one copy has been given.
Goes beyond the federal floor: yes.
Disclosure to individual appealing denial of Social Security benefits. ORS 192.576(1)
In force · effective · quote not yet matched word for word to our stored copy of the page · read October 3, 2026 · source(oregonlegislature.gov)
In the case of an individual appealing the denial of Social Security disability benefits, a covered entity shall upon request provide to the individual or the individual’s personal representative, free of charge, one copy of the individual’s health information
Who it binds, in our words: Covered entities. The free copy covers health information created after the alleged onset date and before the administrative hearing.
Disclosure of written accounts by health care services provider: copy to the individual. ORS 179.505(9)(a)
In force · effective · read October 3, 2026 · source(oregonlegislature.gov)
upon written request of the individual or a personal representative of the individual, shall be disclosed to the individual or the personal representative of the individual within a reasonable time not to exceed five working days
Who it binds, in our words: Medical personnel or other staff employed by or under contract with a public provider to provide health care or maintain written accounts of health care provided to individuals
Health care provider and state health plan charges. ORS 192.563
In force · effective · read October 3, 2026 · source(oregonlegislature.gov)
No more than $30 for copying 10 or fewer pages of written material, no more than 50 cents per page for pages 11 through 50 and no more than 25 cents for each additional page
Who it binds, in our words: A health care provider or state health plan that receives an authorization to disclose protected health information
Second check by a separate agent: confirmed.
Can you say no to sharing through a health information exchange (a network that passes records between doctors)?
Federal floor: HIPAA lets providers share records for treatment without asking you.
No law found We searched the official code and found none.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
ORS 413.300 to 413.308 set up a Health IT council but no HIE consent rule. No current state-designated HIE or published HIE consent policy was found.
Designated exchange: None found. OHA ended its CareAccord service on March 31, 2018.
How we searched (October 3, 2026): the official code search for health information exchange, information exchange, opt out, opt in, consent (ORS 413.300 to 413.308). Agency pages checked: oregon.gov, oregonlegislature.gov.
Second check by a separate agent: confirmed.
Are some sensitive records, like mental health or HIV, given extra rules?
These answers record whether a rule exists and what it says. They say nothing about whether any care is legal or available.
Reproductive health records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
The rule covers information held by the Oregon Health Authority. The act took effect on March 31, 2026 under an emergency clause.
Confidentiality of individually identifiable information (legally protected reproductive or gender-affirming health care). Oregon Laws 2026, chapter 52, section 9(2)(c) (HB 4088), added to ORS 435.190 to 435.245
Is confidential, nondiscoverable and inadmissible in any judicial or administrative proceeding that is not directly connected with the authority’s administration of the state medical assistance program or the programs described in ORS 435.230.
Who it binds, in our words: Individually identifiable information obtained by the Oregon Health Authority that relates to applications for or receipt of legally-protected reproductive or gender-affirming health care activities, unless the individual consents.
Second check by a separate agent: confirmed.
Mental health records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Public providers include community mental health programs and Oregon State Hospital campuses. Current text from 2025 c.60, effective January 1, 2026.
Disclosure of written accounts by health care services provider: psychotherapy notes. ORS 179.505(17)(a)
In force · effective · read October 3, 2026 · source(oregonlegislature.gov)
Except as provided in paragraph (b) of this subsection, a health care services provider must obtain an authorization from an individual or a personal representative of the individual to disclose psychotherapy notes.
Who it binds, in our words: Medical personnel or other staff employed by or under contract with a public provider to provide health care or maintain written accounts of health care provided to individuals
Second check by a separate agent: confirmed.
HIV records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Disclosure is allowed where federal or state law or rule requires or permits it. Latest amendment 2019 c.456.
Notice of HIV test required; exceptions (confidentiality of test identity and results). ORS 433.045(4)(a)
In force · effective · read October 3, 2026 · source(oregonlegislature.gov)
a person may not disclose or be compelled to disclose the identity of any individual upon whom an HIV-related test is performed, or the results of such a test in a manner that permits identification of the subject of the test
Who it binds, in our words: Any person, regardless of the manner of receipt or the source of the information.
Second check by a separate agent: confirmed.
Genetic records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Part of the Oregon genetic privacy statutes, ORS 192.531 to 192.549. Latest amendment 2019 c.141. Date source: 2019 c.141 s.29(1), HB 2464 enrolled text on olis.oregonlegislature.gov.
Disclosure of genetic information; exceptions. ORS 192.539(1)
In force · effective · quote not yet matched word for word to our stored copy of the page · read October 3, 2026 · source(oregonlegislature.gov)
a person may not disclose or be compelled, by subpoena or any other means, to disclose the identity of an individual upon whom a genetic test has been performed
Who it binds, in our words: Any person, regardless of the manner of receipt or the source of genetic information.
Second check by a separate agent: disputed, then settled by a ruling drafted by an agent against the law's text and approved by the authors on October 3, 2026.
Can you sue if your records are misused?
Yes. You can sue over unlawful collection, use or sharing of medical records or health data in general.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
ORS 179.507 lets a person sue for any unlawful disclosure of records held by public providers. That covers medical records generally, but only public providers. The consumer privacy act has no private right.
Damages a court may award: ORS 179.507(2): actual damages or $500, whichever is greater, plus punitive damages for intentional violations and attorney fees. ORS 192.541: greater of actual damages or $100 to $250,000 by type of genetic privacy violation.
Enforcement of ORS 179.495 and 179.505; actions; venue; damages. ORS 179.507(2)
In force · effective · read October 3, 2026 · source(oregonlegislature.gov)
If a violation of ORS 179.495 or 179.505 is proven, the person commencing the action shall recover actual damages or $500, whichever is greater.
Who it binds, in our words: Medical personnel or other staff employed by or under contract with a public provider to provide health care or maintain written accounts of health care provided to individuals
Genetic privacy: private right of action. ORS 192.541(1)
In force · effective · quote not yet matched word for word to our stored copy of the page · read October 3, 2026 · source(oregonlegislature.gov)
blood relative, representative or estate may bring a civil action against any person who violates ORS 192.535, 192.537, 192.539 or 192.547.
Who it binds, in our words: Any person who violates the genetic privacy statutes named.
In force · effective · quote not yet matched word for word to our stored copy of the page · read October 3, 2026 · source(oregonlegislature.gov)
ORS 646A.570 to 646A.589, or any other laws of this state, do not create a private right of action to enforce a violation of ORS 646A.570 to 646A.589.
Who it binds, in our words: Oregon Consumer Privacy Act.
Second check by a separate agent: confirmed.
Must you be told if health data leaks in a breach?
Yes. The breach notice law covers both medical information and health insurance information.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Both medical and health insurance information are in the definition (2019 c.180, effective January 1, 2020). HIPAA-compliant entities are exempt, but ORS 646A.604(10) still requires a copy of notices to the Attorney General.
Deadline to tell people: Most expeditious manner possible, without unreasonable delay, but not later than 45 days after discovery.
The attorney general or a regulator must also be told.
A business that follows HIPAA's breach rules is treated as following this law.
Oregon Consumer Information Protection Act: definition of personal information. ORS 646A.602(12)(a)(A)(vi) and (vii)
In force · effective · quote not yet matched word for word to our stored copy of the page · read October 3, 2026 · source(oregonlegislature.gov)
A consumer’s health insurance policy number or health insurance subscriber identification number in combination with any other unique identifier that a health insurer uses to identify the consumer; or (vii) Any information about a consumer’s medical history or mental or physical condition
Who it binds, in our words: In combination with the consumer’s first name or first initial and last name, if not rendered unusable.
Notice of breach of security: deadline. ORS 646A.604(3)(a)
In force · effective · quote not yet matched word for word to our stored copy of the page · read October 3, 2026 · source(oregonlegislature.gov)
A covered entity shall give notice of a breach of security in the most expeditious manner possible, without unreasonable delay, but not later than 45 days after discovering or receiving notification of the breach of security.
Who it binds, in our words: Covered entities as defined in ORS 646A.602.
Notice of breach of security: Attorney General. ORS 646A.604(1)(b)
In force · effective · quote not yet matched word for word to our stored copy of the page · read October 3, 2026 · source(oregonlegislature.gov)
The Attorney General, either in writing or electronically, if the number of consumers to whom the covered entity must send the notice described in paragraph (a) of this subsection exceeds 250.
Who it binds, in our words: Breaches affecting more than 250 consumers.
Notice of breach of security: HIPAA exemption. ORS 646A.604(9)(d)
In force · effective · quote not yet matched word for word to our stored copy of the page · read October 3, 2026 · source(oregonlegislature.gov)
A covered entity or vendor that complies with regulations promulgated under the Health Insurance Portability and Accountability Act of 1996 (P.L. 104-191, 110 Stat. 1936) and the Health Information Technology for Economic and Clinical Health Act of 2009
Who it binds, in our words: This section does not apply to entities complying with HIPAA and HITECH, if the personal information is also subject to those Acts.
Second check by a separate agent: confirmed.
Are there rules for AI used in your care?
The three rules we look for: you must be told when AI is used in your care; a licensed clinician decides, not AI alone; you can reach a human, or have a human review the decision. Each counts only if the law names health care or health coverage.
No. A law is in force, but it has none of the three rules.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
No disclosure, clinician review or human recourse rule for AI in care or coverage found. The 2026 AI companion act (2026 c.85, effective January 1, 2027) does not cover care or coverage decisions.
You must be told when AI is used in your care: not found.
A licensed clinician decides, not AI alone: not found.
You can reach a human, or have a human review the decision: not found.
Related limit on AI (recorded, not counted in the answer): ORS 678.027: "A nonhuman entity, including but not limited to an agent powered by artificial intelligence, may not use any of the following titles: (1) Advanced Practice Registered Nurse or the abbreviation APRN" (also RN, LPN, NP, CRNA, CNS, CMA, CNA).
Use of titles by nonhuman entity. ORS 678.027
In force · effective · read October 3, 2026 · source(oregonlegislature.gov)
A nonhuman entity, including but not limited to an agent powered by artificial intelligence, may not use any of the following titles:
Who it binds, in our words: Any nonhuman entity, including an agent powered by artificial intelligence.
Second check by a separate agent: confirmed.
Rights in practice: the setting
These public figures describe conditions that can affect whether people are able to use the rights above, such as health insurance and internet at home. They are not scored, not part of any answer, and not a reason for any answer. Each is the latest the source publishes for the state, checked against the publisher (the Census Bureau or the Bureau of Labor Statistics); grouped under the Healthy People 2030 social determinants of health.
Source and period on every row. Figures from DataSpine, each checked against its publisher. Not scored.
Figure
Value
Source and period
People under 65 without health insuranceHealth care access and quality
6.6%
Small Area Health Insurance Estimates, SAHIE 2024 (single-year model estimate)
Households with a computerHealth care access and quality
95.7%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households with a broadband internet subscriptionHealth care access and quality
90.5%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households with a smartphone and no other computerHealth care access and quality
6.7%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Median household incomeEconomic stability
$76,632 (2022 dollars)
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Unemployment rateEconomic stability
5.3%
Local Area Unemployment Statistics, December 2025, monthly, seasonally adjusted
Households without a vehicleNeighborhood and built environment
7.0%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
People who speak a language other than English at homeSocial and community context
15.3%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households of one person aged 65 or overSocial and community context
12.1%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Not shown: the number of people below the poverty line and the number with a bachelor's degree, which are available only as counts, and counts do not compare across states of different size.
Not shown yet, with no checked state figure: Medicare members who also have Medicaid; Medicaid enrollment; primary care supply; social vulnerability, income and jobs; people in nonmetro counties; social vulnerability, housing and transport; social vulnerability, household and minority themes.
Also recorded: a data broker registry
A fact, not part of any answer above. In force It offers no state way to ask brokers to delete your data.
Data brokers: requirement to register with Department of Consumer and Business Services. ORS 646A.593(2)(a)
In force · effective · quote not yet matched word for word to our stored copy of the page · read October 3, 2026 · source(oregonlegislature.gov)
a data broker may not collect, sell or license brokered personal data within this state unless the data broker first registers with the Department of Consumer and Business Services as provided in subsection (3) of this section.
Who it binds, in our words: A business entity or part of a business entity that collects and sells or licenses brokered personal data to another person. Registration requires only a statement of whether residents may opt out.
Another state
This study covers the 50 states and Washington, DC. It does not cover the US territories (Puerto Rico, Guam, the US Virgin Islands, the Northern Mariana Islands and American Samoa).
Built by SuperTruth, which checks whether a record can be trusted before an AI acts on it. About SuperTruth · How we used AI
Health Record Rights Index by SuperTruth. Research by AI agents built on Anthropic's Claude, checked by a second agent and ruled by the authors; how we did it. Research tool, not legal advice. Text CC BY 4.0.
