Oregon Statutes 432.033 – Duties of state registrar related to confidentiality and security
(1) The Legislative Assembly finds that:
Terms Used In Oregon Statutes 432.033
- Decedent: A deceased person.
- Evidence: Information presented in testimony or in documents that is used to persuade the fact finder (judge or jury) to decide the case for one side or the other.
- Fraud: Intentional deception resulting in injury to another.
- Health research: means a systematic study to gain information and understanding about health, with the goal of finding ways to improve human health, that conforms to or is conducted in accordance with generally accepted scientific standards or principles and that is designed to develop or contribute to general scientific knowledge. See Oregon Statutes 432.005
- Live birth: means the complete expulsion or extraction from its mother of a product of human conception, irrespective of the duration of pregnancy, that, after such expulsion or extraction, breathes or shows any other evidence of life such as beating of the heart, pulsation of the umbilical cord or definite movement of voluntary muscles, whether or not the umbilical cord has been cut or the placenta is attached. See Oregon Statutes 432.005
- Personally identifiable information: means information that can be used to distinguish or trace an individual's identity or, when combined with other personal or identifying information, is linked or linkable to a specific individual. See Oregon Statutes 432.005
- Record: means a report that has been registered by the state registrar. See Oregon Statutes 432.005
- Registration: means the process by which vital records and reports are accepted and incorporated into the official records of the Center for Health Statistics. See Oregon Statutes 432.005
- Report: means a document, whether in paper or electronic format, containing information related to a vital event submitted by a person required to submit the information to the state registrar for the purpose of registering a vital event. See Oregon Statutes 432.005
- State: includes a state or territory of the United States, the District of Columbia and New York City. See Oregon Statutes 432.005
- United States: includes territories, outlying possessions and the District of Columbia. See Oregon Statutes 174.100
- Vital statistics: means the aggregated data derived from records and reports of live birth, death, fetal death, induced termination of pregnancy, marriage, declaration of domestic partnership, dissolution of marriage, dissolution of domestic partnership and supporting documentation and related reports. See Oregon Statutes 432.005
(a) The system of vital statistics supports civil registration and creates information that is used for public health, health research, national security, statistical and administrative purposes;
(b) Civil registration of each vital event that occurs within this state is carried out primarily for the purpose of establishing legal documents provided by law; and
(c) Due to increased requirements of civil registration in the context of national security and the use of live birth records as the primary document used to identify individuals, the State Registrar of the Center for Health Statistics must:
(A) Take measures to prevent the fraudulent use of vital records for identity theft, terrorism or other purposes;
(B) Maintain the security of personnel, physical environments, electronic systems and preservation methods; and
(C) Perform data assurance and record matching activities to protect the confidentiality and security of vital records and prevent the fraudulent use of vital records.
(2) For the purposes described in subsection (1) of this section, the state registrar shall:
(a) Authenticate all users of the system of vital statistics and document that the users require access to the system of vital statistics for purposes related to the official roles and duties of the users;
(b) Authorize authenticated users of the system of vital statistics to access specific components of the system of vital statistics that are necessary for the users to perform their official roles and duties;
(c) Establish separate duties for staff who have roles that may be susceptible to fraud or misuse and routinely perform audits of staff work for the purpose of identifying fraud or misuse within the system of vital statistics;
(d) Require that authenticated and authorized users maintain a specified level of training related to security and provide written acknowledgment of security procedures and penalties;
(e) Validate data provided in reports submitted for registration through site visits or with sources independent from registration processes at a frequency specified by the state registrar by rule that maximizes the integrity of the data collected;
(f) Protect personally identifiable information and maintain systems that provide for audits of use and include protocols for breach identification and notification;
(g) If the decedent was born in this state or if the decedent was a resident of this state, receive a report from the United States Department of Defense or the United States Department of State of a death occurring outside the United States;
(h) Match death records to live birth records;
(i) Match death records received from the United States Department of Defense or the United States Department of State of a death occurring outside the United States to registered live birth records;
(j) Work with law enforcement to provide evidence for active fraud investigations;
(k) Provide secure workplace, storage and technology environments;
(L) Maintain overt, covert and forensic security measures for certified copies, verifications and automated systems that are part of the system of vital statistics;
(m) Comply with laws, rules and regulations associated with information technology systems and information related to the system of vital statistics; and
(n) Comply with national standards that apply to the system of vital statistics and its components. [2013 c.366 § 6]