Topics
A to Z
Data &
 Statistics
Forms &
Publications
News &
Advisories
Licensing &
Certification
Rules &
Regulations
Public Health
Directory
Print this Article   Bookmark and Share
Is My Confidentiality Protected?
Information Security

Yes, the OMMP protects your confidentiality!


  • The OMMP works from a locked and secure office.
  • The OMMP keeps all computer and paper files locked and secure when not in use.
  • Authorized employees of state or local law enforcement agencies may only access the OMMP database as necessary to verify that a person is a lawful possessor of a registry identification card or the designated primary caregiver of a lawful possessor of a registry identification card or that a location is an authorized marijuana grow site.¬†ORS 475.331 does not authorize the use of the OMMP database for purposes of helping to determine whether an individual uses, or may use, marijuana.
  • OMMP staff tells officers from state or local law enforcement agencies "yes" or "no" when asked: (1) if a specific person has a valid registry identification card; (2) if a specific person is a caregiver of a patient; (3) if a specific person has a pending application, or (4) if a specific address is a registered "grow site". This "yes" or "no" practice is called "verification", because we only verify specific questions asked of us.
  • OMMP staff do not give out other information to law enforcement. For example, if an OMMP staff member is asked by an officer to give out the name of a patient's designated primary caregiver, the staff member tells the officer that such information is confidential and can only be verified if OMMP staff is given specific information (name or address) to verify.
  • The OMMP follows all Department of Human Services policies on the Health Insurance Portability and Accountability Act (HIPAA). HIPAA uses terms such as "identified data" and "de-identified" or "non-identifying data." "Identified data" means data that can specifically identify individuals, such as name or date of birth. "De-identified" or "non-identifying data" means data that protects the identity of specific individuals. For example, a count of the number of patients currently registered with the OMMP does not allow the identification of specific individuals.
  • When asked for information by newspaper or TV reporters, for example, the OMMP gives out only counts--not names, addresses, dates of birth, or other "identifying" information. In giving out counts, the OMMP combines small numbers. For example, if a county has fewer than 50 OMMP patients, the OMMP will combine the actual number of patients from that county with one or more other counties that have fewer than 50 patients. The OMMP then gives out a "combined" count of patients for several counties. This protects the actual identity of patients who may live in less-populated areas of the State.
  • The OMMP will disclose patient information to others only at the specific, written request of the patient.