Confidentiality — Understanding the Basics
Confidentiality laws protect your youth’s private health information. They explain who can see, share, or release information. Understanding these rules helps families and providers work together while keeping care safe and respectful.
1. What HIPAA Means
HIPAA stands for the Health Insurance Portability and Accountability Act. It is a federal law that:
- Protects private health information, such as name, birth date, address, diagnosis, or treatment.
- Requires written permission before information is shared with someone not directly involved in care.
- Gives patients the right to see and request copies of their medical records.
To allow providers to talk with each other or with you, a Release of Information (ROI) form is usually needed.
2. Minor-Consent and Parent Rights in Oregon
Under Oregon law, ORS 109.640 – 109-675 (2023 update):
- Current language in Oregon Revised Statute (ORS) 109.675 permits youth age 14 and above to consent to their own outpatient mental health, drug, or alcohol treatment. However, there are no Oregon rules or statutes that permit youth to consent to their own mental health, drug, or alcohol treatment at levels of care other than outpatient. The right to consent is not meant to correspond to a right to refuse.
- A parent or legal guardian can consent to health care, including mental health, drug, or alcohol treatment, on behalf of a youth. OHA’s informed consent provisions in rule are not intended to be a barrier to treatment for a youth, even if the youth is refusing, as long as a parent or guardian consents and the treatment is medically necessary.
- In situations in which a youth aged 14 or older starts and consents to their own outpatient treatment, Oregon law requires that the youth’s parents/guardians be involved “before the end of treatment” unless parents refuse, or there are clear and documented clinical reasons why they should not be involved.
- Youth may ask that certain information stay private, but providers can share details if needed for safety or medical reasons.
Providers must report suspected abuse, neglect, or serious danger to the Oregon Department of Human Services abuse hotline.
3. What a Release of Information (ROI) Does
An ROI form allows a youth or guardian to decide:
- What information can be shared.
- Who it can be shared with.
- How long the permission lasts.
Youth age 14 and older may sign their own ROI. Parents of children under 14 sign for them.
It helps to talk together about what information should be shared so everyone can support safety and healing.
4. Informed Consent for Treatment
Before treatment begins, you or your youth should receive:
- An explanation of the treatment and why it is being used.
- Possible risks and benefits.
- Other treatment options.
Signing an informed consent form means you understand and agree to the plan.
5. Substance-Use Treatment Privacy (42 CFR Part 2)
This federal rule gives extra privacy protection for people receiving treatment for alcohol or drug use.
Programs covered by this rule cannot share information about treatment without written permission.
6. When Providers Can Share Information Without Permission
A provider may share limited information when:
- There is immediate risk of harm.
- Emergency medical care is needed.
- The law requires reporting, such as abuse or a court order.
These rules exist to protect safety and life.
7. Tips for Families
- Talk with your youth’s provider about how information will be shared.
- Keep copies of any signed ROI forms, or a list or who you allowed to talk to who.
- Ask for updates in clear, simple language.
- You do not need an ROI to share safety concerns or background information with providers.
FAQ’s
What if my 14-year-old will not sign an Release of Information at the Emergency Room? How do I advocate for my youth?
In Oregon, youth age 14 and older can consent to treatment for mental health and sign releases information.
As a parent:
- You can consent to treatment and sign ROIs. If this is disputed refer providers to the OHA 2024 Memo on minor consent.
- Share safety concerns with the care team.
- Ask general questions about diagnosis, next steps, and safety.
- Tell staff, “I want to support my youth and keep them safe.”
You are not doing anything wrong by asking to be involved.