Oregon Healthcare Compliance Requirements
State-specific breach notification rules, medical records retention periods, PDMP requirements, and mandatory reporting obligations for medical practices operating in Oregon.
Breach Notification Rules
Notification deadline
45 calendar days
Notification must be made within 45 days of discovering the breach. AG must be notified if 250+ Oregon residents affected.
AG notification threshold
250+ affected individuals
Notify: AG
Harm analysis required
Penalty range
Up to $25,000 per violation under Unlawful Trade Practices Act
Medical Records Retention
| Record type | Retention period | Measured from |
|---|---|---|
| General medical | 10 years | Last treatment |
| Pediatric | 7 years | Patient turns 18 |
PDMP Requirements — Oregon PDMP
Check required
All controlled substances
Check frequency
Every prescription
Delegation allowed
Penalty range
Licensing board discipline; civil penalties up to $5,000 per violation
Exemptions
Hospice patients, cancer treatment, ≤3 day supply in ER, inpatient hospital administration, medication-assisted treatment
Mandatory Reporting Obligations
Mandated reporters
Physicians, nurses, dentists, psychologists, social workers, EMTs, and all healthcare professionals
Report to
Department of Human Services, Child Welfare, or local law enforcement
Timeline
Immediately / as soon as possible
Penalty for failure
Class A violation (civil); Class B misdemeanor if knowingly failed to report
Immunity provision
Good faith reporters immune from civil and criminal liability under ORS 419B.025
Mandated reporters
Physicians, nurses, social workers, and all healthcare professionals
Report to
Department of Human Services, Adult Protective Services, or local law enforcement
Timeline
Immediately / as soon as possible
Penalty for failure
Class A violation
Immunity provision
Good faith reporters immune from civil and criminal liability
Mandated reporters
Healthcare providers are not specifically mandated to report domestic violence in adults
Report to
Local law enforcement (voluntary reporting permitted with patient consent)
Timeline
Immediately / as soon as possible
Immunity provision
Good faith reporters immune from civil liability
Mandated reporters
Physicians, laboratories, healthcare facilities, and infection control practitioners
Report to
Oregon Health Authority, Public Health Division, or local health department
Timeline
Within 24 hours
Penalty for failure
Class C misdemeanor
Immunity provision
Good faith reporters immune from civil liability
Mandated reporters
All healthcare providers treating gunshot wounds or injuries from criminal violence
Report to
Local law enforcement
Timeline
Immediately / as soon as possible
Penalty for failure
Class A violation
Immunity provision
Good faith reporters immune from civil and criminal liability
Stay compliant in Oregon
GuardWell tracks Oregon-specific breach deadlines, PDMP requirements, retention periods, and mandatory reporting obligations automatically.