1. (1) Licensees shall store, maintain and destroy records, including client records, in a manner that prevents unauthorized access, protects client confidentiality and prevents alteration of client records.

   1. (a) All client records and copies of client records, including records created by facilitators, must be stored at the service center where the client participates or intends to participate in an administration session. No client records, nor copies of client records may be stored at a location other than the service center where the client participates or intends to participate in an administration session except for client records that are transferred due to license surrender pursuant to the requirements of OAR 333-333-4280.
   2. (b) Service centers may store electronic records on cloud-based platforms that use security measures to effectively prevent unauthorized access and protect client confidentiality. Electronic records must be accessible at the licensed premises. Electronic records stored pursuant to this subsection are considered to be stored at the service center.
   3. (c) If additional documentation is created which meets the definition of client records and is not required by these rules, it must be promptly incorporated with other client records.
2. (2) Unless otherwise specified in these rules, licensees must retain required records for a period of five years. For example, licensees must retain security video required by OAR 333-333-4650 for a period of 30 calendar days.
3. (3) Facilitators must inform clients of the service center location which receives and stores the clients’ records. Service centers must allow current and former clients to access and examine their own client records and request an addendum to those records. Following the retention period described in section (2) of this rule a service center must destroy client records upon the client’s request.
4. (4) Service centers must allow facilitators who will provide or have provided psilocybin services at the service center to access and examine client records related to those services. Facilitators may not access the records of other clients without the client’s prior written consent and may not alter the records.
5. (5) Licensee representatives of a service center may not access client records, without the client’s prior written consent, unless doing so is necessary to support operations of the service center where the client has received or will receive psilocybin services.
6. (6) Service centers must create and retain a confidentiality plan that describes practices and procedures for storing and maintaining records on the licensed premises in a manner that prevents unauthorized access, protects client confidentiality and prevents alteration of client records. This plan must be provided to the Oregon Health Authority (Authority) upon request.
7. (7) If a service center license is revoked, surrendered or expired the Authority may address in an order the manner and condition under which client records held by the licensee must be destroyed or transferred to other licensees.
8. (8) If a service center requests to surrender its license the Authority may grant permission in writing for the service center to destroy client records or transfer the records to another service center after completing client consent forms described in OAR 333-333-4810(2).

Statutory/Other Authority

ORS 475A.235

Statutes/Other Implemented

ORS 475A.235

History

PH 21-2025, amend filed 10/24/2025, effective 01/01/2026
PH 82-2024, amend filed 11/22/2024, effective 01/01/2025
PH 58-2023, amend filed 12/21/2023, effective 01/01/2024
PH 206-2022, adopt filed 12/27/2022, effective 12/27/2022