Topics
A to Z
Data &
 Statistics
Forms &
Publications
News &
Advisories
Licensing &
Certification
Rules &
Regulations
Public Health
Directory
Is My Confidentiality Protected?
Information Security

Yes, the OMMP protects your confidentiality!

  • The OMMP:
  • Is located within a secure office,
  • Keeps all computer and paper files locked and secure when not in use, and
  • Follows all Oregon Health Authority confidentiality policies.
  • Authorized employees of state or local law enforcement agencies may only access the OMMP database as necessary to verify:
  • A person is a lawful possessor of a registry identification card,
  • A person is a designated primary caregiver of a lawful possessor of a registry identification card, or
  • A location is an authorized marijuana growsite. 
  • ORS 475.331 does not authorize the use of the OMMP database for purposes of helping to determine whether an  individual may potentially use marijuana.
  • OMMP staff answer the following questions from officers of state or local law enforcement agencies with only "yes" or "no" replies:

1. If a specific person has a valid registry identification card,

2. If a specific person is a caregiver of a patient,

3. If a specific person has a pending application, or

4. If a specific address is a registered "growsite".

OMMP staff members do not give out any other information to law enforcement.

  • Staff members categorize information into "identified data" and "de-identified" or "non-identifying data."

"Identified data" means data that can specifically identify individuals, such as name or date of birth.

"De-identified" or "non-identifying data" means data that protects the identity of specific individuals.

For example, a count of the number of patients currently registered with the OMMP does not allow the identification of specific individuals.

  • When asked for information by newspaper or TV reporters, OMMP staff members provide only non-identifying data, such as counts.
  • The OMMP combines small number counts.

  • The OMMP will disclose patient information to others only at the specific, written request of the patient.