Text Size:   A+ A- A   •   Text Only
Site Image

HIPAA Compliance, Liability and Confidentiality of At-Risk Driver Reports


This page provides information about HIPPA compliance, liability and confidentiality related to the mandatory and voluntary reporting of at-risk drivers, i.e., individuals who have a limitation or condition that interferes with or diminishes their ability to drive safely.

HIPAA Compliance
For purposes of sharing medical information under the Health Insurance Portability and Accountability Act (HIPAA), DMV is considered a public health entity. DMV is the state agency responsible for public health matters relating to the monitoring of drivers who may be ineligible for driving privileges because of a cognitive or functional impairment that affects the driver’s ability to drive safely. 
The medical information contained in the reports required by DMV is confidential and shall only be used to determine the qualification of a person to safely operate a motor vehicle, and for taking any action deemed necessary by DMV. The protected health information required to be reported by Administrative Rule is the minimum necessary to accomplish this purpose. 
To protect the privacy of the information being shared, DMV does not allow reports to be filed via Internet or email. They may only be faxed or mailed to DMV. Once received, the information from the reports is entered into a database that is protected behind an electronic firewall.

Liability: Mandatory Reports
Oregon Revised Statutes (ORS) 807.710 states that "if a designated physician or health care provider makes a report to the department in good faith, that person shall be immune from civil liability that might otherwise result from making the report. If a designated physician or health care provider does not make a report, that person shall be immune from civil liability that might otherwise result from not making a report." 
This applies to physicians and health care providers who report in good faith and whose patient has met the mandatory reporting threshold of "severe and uncontrollable" as defined in Administrative Rule.
Liability: Non-Mandatory Reports
Civil immunity is extended to health care professionals who report in good faith under non-mandatory (voluntary) reporting program. This immunity clause only covers physicians and health care providers who are reporting a patient and submit voluntary reports in good faith. It does not cover individuals outside the health care profession who submit voluntary reports to DMV.
DMV will not accept anonymous reports. However, voluntary reporters may ask DMV to keep their names confidential. DMV may not be able to keep the request confidential if the driver requests a hearing or files a lawsuit against the DMV.
Related Information
Additional information that may be relevant includes: