House of Representative Bill ('HB') 3284 on personal health data was introduced, on 23 February 2021, to the Oregon House of Representatives. In particular, the bill would provide resident individuals in Oregon rights such as the right to protection of the privacy of personal health data and would amend ORS 646.607. Moreover, the bill aims to, among other things:

• prohibit data controllers from collecting, using, or disclosing personal data about resident individual who has not given affirmative express consent for collection, use, or disclosure unless in context of employment relationship or to comply with legal obligation;

• prohibit data controllers from retaining, storing, or using personal health data and require covered organisations to destroy, delete, or render inaccessible personal health data not later than specified dates unless personal health data consists of aggregations, statistical analyses, compilations, or interpretations and the covered organisation takes reasonable measures to ensure that personal health data does not and cannot personally identify the resident individual; 

• require data controllers to collect, receive, or use personal health data only for specified purposes; and

• provide the resident individual with certain disclosures and the ability to revoke affirmative express consent for collection, receipt, or use of personal health data, except in specified circumstances.

You can track the bill here and read the bill here.

UPDATE (30 April 2021)

Oregon House of Representatives passes bill on health data protection

The Oregon House of Representatives passed, on 28 April 2021, HB 3284 enhancing the protection of personal health data related to COVID-19, which will now advance to the Oregon Senate.

You can read the bill and track its progress here.