General Obligations and Limitations Regarding Confidentiality
The University of Oregon is committed to upholding legal and professional obligations to protect confidentiality. Confidentiality is central to the effective provision of health care and survivors’ services. Providers of health care and/or survivors’ services have a duty to carry out the obligations of confidentiality imposed by law, professional codes of ethics, and this policy. In most circumstances, providers involved in the care of clients/patients shall not disclose information without written authorization from the client/patient. Disclosures made pursuant to exceptions arising from federal and state laws or professional codes of ethics shall be limited to the minimum information necessary.

Litigation and Confidentiality
When the University of Oregon is involved, or anticipates being involved in a legal proceeding, the University of Oregon has chosen to uphold a more protective standard with regard to confidential health care and survivors’ services information than may be required under state and federal laws, and professional codes of ethics. The following describes the standards that the University of Oregon will follow in relation to legal proceedings or anticipated legal proceedings.

1. If information needs to be preserved, the University of Oregon will implement a litigation hold. General Counsel will direct appropriate university personnel outside of the Office of General Counsel to ‘hold in-place’ all potentially relevant confidential records and/or direct relevant Information Technology staff to institute an “IT hold” for such records, in order to ensure compliance with a litigation hold. Each unit that creates or maintains such records will develop a litigation hold-in-place procedure to be approved by General Counsel.
2. In response to an actual or anticipated lawsuit, board complaint, or other legal proceeding initiated by a client/patient regarding the provision of health care and/or survivor's services (i.e. professional negligence related to these services), the University of Oregon may access and use that client/patient's confidential health and/or survivors’ services information related to such services to defend itself and those who provide services in a manner consistent with state and federal law, and professional ethics. The University will access the information via a subpoena whenever it is possible to issue a subpoena. If it is not possible to issue a subpoena, the University will provide the client/patient notice and an opportunity to object to accessing the information before any accessing of the information occurs.
3. When the University of Oregon is a party (or may become a party) to a lawsuit with a claim that is not covered by paragraph #2, and receives a subpoena or request from an outside party for records that include confidential health care and/or survivors’ services information, the University, its health centers/clinics, providers, and confidential responders will, if there is a good faith basis under applicable law, resist subpoenas or other requests, notify the client/patient of the subpoena or request, inform the client/patient of their right to seek independent legal advice, and release privileged information only in response to an order from a court or tribunal, a stipulated protective order that the client/patient has signed, or a written authorization from the client/patient. Prior to any access by University officials, in cases of a disagreement with General Counsel, in order to ensure that the University respects legal and professional obligations to protect confidentiality a provider/custodian of record may request University funding for independent legal counsel concerning the disclosure of records. Denial of such a request may be appealed to the University President.
4. In instances not covered by paragraph #2, if existing law (e.g., FERPA, HIPAA, state law) allows University officials to access a client/patient’s confidential health care and/or survivors’ services information, University officials will forgo access without a stipulated protective order that the client/patient has signed, a written authorization from the client/patient to use the records, or a court order. Prior to any access by University personnel, in cases of a disagreement with General Counsel, in order to ensure that the University respects legal and professional obligations to protect confidentiality a provider/custodian of record may request University funding for independent legal counsel concerning the disclosure of records. Denial of such a request may be appealed to the University President.
5. When the University of Oregon is a non-party in a legal proceeding (i.e., neither the plaintiff nor the defendant) and receives a subpoena for records that include confidential health care and/or survivors’ services information, the University of Oregon will, if there is a good faith basis under applicable law, resist subpoenas or other requests, notify the client/patient of the subpoena or request, inform the client/patient of their right to seek independent legal advice, and release privileged information only in response to an order from a court or tribunal, a stipulated protective order that the client/patient has signed, or a written authorization from the client/patient. Prior to any access by University officials, in cases of a disagreement with General Counsel, in order to ensure that the University respects legal and professional obligations to protect confidentiality a provider/custodian of record may request University funding for independent legal counsel concerning the disclosure of records. Denial of such a request may be appealed to the University President.
6. Nothing in this policy shall be construed to require those subject to this policy to violate any state or federal legal or ethical obligations. Nor shall this policy be construed to limit the ability of a provider to act in the best interests of the provider’s client/patient, consistent with state and federal law.
7. Nothing in this policy shall be construed to limit the ability of a University health center or clinic to obtain professional liability and/or general liability insurance coverage and comply with the terms of that coverage, including consulting outside counsel or other medical professionals for risk mitigation, or to establish, at the health center or clinic’s option, a risk management team that operates inside any center or clinic. University employees selected by the center or clinic to participate on and provide support services to such a team (e.g., risk management, compliance, administration, information technology, billing) will have access to health and/or survivors’ services information only within the physical confines of the respective center and only after the name and any other identifying information, as much as is feasible in the circumstances, of the client/patient has been removed from such information.

Advice and Information for Clients and Patients
Confidentiality is a complex issue, and the issues can vary depending on the specific services that a client or patient receives, the records created as part of those services, and the laws that apply. Thus, it is essential that clients/patients discuss confidentiality with their specific providers. It is also important that clients and patients served by University of Oregon clinics, health centers, and confidential responders know who has access to information that clients/patients share with their providers, and under what conditions confidential information may be used or disclosed. University of Oregon health centers, clinics, and confidential responders will provide written information to every client/patient that describes the confidentiality of the client/patient's health care or survivors’ services information and provides a link to this policy.

Implementation and Review of University of Oregon Health Center, Clinic, or Confidential Responder Confidentiality Policies and Practices
Every health center, clinic, or confidential responder (i.e., unit) that creates, receives, maintains, or transmits confidential health information must have policies and practices in place that follow all applicable state and federal laws, reflect the highest professional standards of confidentiality, and comply with this policy.

Definitions

For purposes of this policy:

Confidential health and/or survivors’ services information is information that is “personally identifiable” to the client/patient at the time it is disclosed, as that term is used by the applicable state and federal law governing the specific information.