Department of Administrative Services
Chapter 125
Division 55
STATE PURCHASING
125-055-0125
Methods of Compliance
In addition to referencing compliance with this Rule in a Contract with a Business Associate, Agency may comply with this Rule in any of the following ways:
(1) Memorandum of Understanding. If a Business Associate is a government entity, the parties may comply with the requirements of this Rule by entering into a memorandum of understanding that accomplishes the objectives of this Rule and meets the Business Associate requirements of the Privacy Rule and the Security Rule.
(2) Amendment. Agency may comply with the requirements of this Rule by executing an amendment or rider that amends Agency's Contract and that contains the contract provisions required by this Rule.
(3) Required by Law. If a Business Associate is Required by Law to perform a function or activity on behalf of an Agency or to provide a service described in the definition of Business Associate to an Agency, such Agency may disclose Protected Health Information to the Business Associate to the extent necessary to comply with the legal mandate without meeting the requirements of this Rule, provided that the Agency attempts in good faith to obtain satisfactory assurances required by OAR 125-055-0115, and, if such attempt fails, documents the attempt and the reasons that such assurances cannot be obtained.
Statutory/Other Authority: ORS 184.305, 184.340 & 279A.140
Statutes/Other Implemented: ORS 279A.140 & The Health Insurance Portability and Accountability Act of 1996, 42 USC 1320d -1320d-8, PL 104-191, sec. 262 & sec. 264
History:
DAS 4-2013, f. 12-17-13, cert. ef. 1-1-14
DAS 4-2010, f. & cert. ef. 11-15-10
DAS 2-2010(Temp), f. & cert. ef. 7-26-10 thru 1-17-11
DAS 12-2005, f. 10-21-05, cert. ef. 10-22-05
Reverted to DAS 3-2003, f. & cert. ef. 6-27-03
DAS 5-2005(Temp), f. & cert. ef. 4-20-05 thru 10-17-05
DAS 3-2003, f. & cert. ef. 6-27-03
DAS 9-2002(Temp), f. & cert. ef. 12-31-02 thru 6-28-03