1. (1) Except as provided in section (2) of this rule, upon termination of the contract for any reason, the business associate shall, at the request of the Authority, return or destroy all protected health information and electronic protected health information created, maintained or received by the business associate from the Authority or on the Authority’s behalf.

   1. (a) This section shall apply to protected health information and electronic protected health information that is in the possession of subcontractors or agents of the business associate.
   2. (b) Business associate may not retain copies of the protected health information and electronic protected health information.

2. (2) If the business associate determines that returning or destroying the protected health information or electronic protected health information is not feasible, the business associate shall provide the Authority notification of the conditions that make return or destruction not feasible.

   1. (a) Upon the Authority's written acknowledgement that return or destruction of protected health information or electronic protected health information is not feasible, the business associate shall continue to provide the protections to the information required by these rules and the contract.
   2. (b) Business associate shall limit further uses and disclosures of the information to those purposes that make the return or destruction not feasible, for as long as the business associate maintains the protected information.

Statutory/Other Authority

ORS 413.042

Statutes/Other Implemented

ORS 179.505, 192.553, 192.556 - 192.581, 413.032, 413.042 & 414.065

History

OHA 1-2014, f. 2-12-14, cert. ef. 2-18-14
OHA 1-2013(Temp), f. & cert. ef. 8-23-13 thru 2-18-14