1. (1) A service center or facilitator may not disclose any information that may be used to identify a client, or disclose any communication made by a client related to psilocybin services or selling psilocybin products to a client to any person including other clients, except with a client’s consent or otherwise as allowed by ORS 475A.450. Service centers may allow facilitators to access records related to services a facilitator provided to clients at the service center without the client’s consent. A licensed facilitator may only access client records for clients to whom they have provided preparation, administration, or integration sessions. A licensed facilitator may not access the client records of any other client unless the client has provided prior written consent and the facilitator accesses the records for the purpose of providing services to the client.

2. (2) A service center must have a completed client consent form to disclose identifiable client information that contains the following:

   1. (a) A specific description of the client’s identifiable information to be used or disclosed.
   2. (b) The name or specific identification of the person(s) or class of person(s) the client’s information will be disclosed to.
   3. (c) The specific purpose for which the information will be used or disclosed.
   4. (d) The date and signature of the client.
   5. (e) An expiration date when the consent to use or disclose is withdrawn.
3. (3) A service center or facilitator must use the client written consent form provided by the Oregon Health Authority (Authority) to meet the requirements of section (2) of this rule. The consent form is available on the Authority’s website.
4. (4) If a client consents to disclose their identifiable client information the client consent form described in section (2) of this rule must be completed at least 24 hours prior to the client’s administration session or at least 72 hours after the conclusion of the client’s administration session. If a client chooses to withdraw their consent form described in section (2), they may do so by providing written notice to the service center or facilitator in a form and manner prescribed by the Authority.

5. (5) A service center or facilitator must provide a client with a disclosure form during or prior to a preparation session if the facilitator or service center intends to share de-identified data related to the client’s receipt of psilocybin product or services.

   1. (a) The disclosure form must contain:

      1. (A) The name of the person or organization that will receive de-identified data.
      2. (B) The specific purpose for which the de-identified data will be used or disclosed.
      3. (C) The date the form was provided to the client and client signature acknowledging receipt.
      4. (D) An option that allows the client to opt out of having their de-identified data disclosed to third parties.
   2. (b) The disclosure form is not required when reporting required data to the Authority pursuant to OAR 333-333-4910 and may not be used for clients to request that their data be withheld from the Authority as described in OAR 333-333-4900(4).
6. (6) A service center or facilitator must use the disclosure form provided by the Authority to meet the requirements of section (5) of this rule. The disclosure form is available on the Authority’s website.
7. (7) If a client chooses to withdraw their disclosure form described in section (5), they may do so by providing written notice to the service center or facilitator in a form and manner prescribed by the Authority.
8. (8) Service centers are not required to complete consent forms for disclosure required by section (2) of this rule when releasing a client’s own records to a client who received services. These records may not contain information that could identify other clients.
9. (9) Service centers and facilitators are not required to complete disclosure forms required by section (5) of this rule when sharing de-identified data describing the total number of clients to whom the licensee has provided preparation, administration, and integration sessions.
10. (10) Service centers and facilitators may not alter client records after the completion of preparation, administration or integration sessions. Service centers and facilitators may create an addendum to existing records.

Statutory/Other Authority

ORS 475A.235

Statutes/Other Implemented

ORS 475A.235, ORS 475A.450 & ORS 475A.372

History

PH 82-2024, amend filed 11/22/2024, effective 01/01/2025
PH 58-2023, amend filed 12/21/2023, effective 01/01/2024
PH 206-2022, adopt filed 12/27/2022, effective 12/27/2022