What applies to a hospital in Oregon

Applies to: HIPAA covered entities and business associates that use tracking technologies on websites or mobile apps

HHS guidance for HIPAA covered entities: tracking technologies on patient portals and apps may not send PHI to vendors without a business associate agreement or patient authorization.

Applies to: Businesses that control or process personal data of 100,000 or more Oregon consumers, or of 25,000 or more while deriving at least 25 percent of gross revenue from selling personal data

Binds businesses, nonprofits included, over 100,000 Oregon consumers; PHI-only exemption, so practices and hospitals over the threshold need consent for other sensitive data, though most practices fall below it.

Applies to: Covered entities under Section 1557 that use patient care decision support tools

OCR guidance on 45 CFR 92.210 for Section 1557 covered entities, such as practices and hospitals; it changes no coverage, payment or licensure decision reaching physicians.

Applies to: Covered entities under Section 1557 of the Affordable Care Act: health programs and activities receiving HHS federal financial assistance, HHS-administered programs and ACA Exchanges

Binds Section 1557 covered entities, such as practices and hospitals receiving HHS funds, on decision support tools; it changes no coverage, payment or licensure decision reaching physicians.

Applies to: Controllers subject to the Oregon Consumer Privacy Act

Binds Oregon Consumer Privacy Act controllers; PHI-only exemption, so practices and hospitals over the act's thresholds may not sell precise geolocation or under-16 data, though most practices fall below them.

Applies to: Nonhuman entities, including agents powered by artificial intelligence, in Oregon

Bars any nonhuman entity, including an AI agent a practice or hospital deploys, from using nursing titles; the deploying entity answers for its agent, not the individual physician.

Applies to: HIPAA covered entities and the vendors that handle PHI for them

HHS guidance for HIPAA covered entities: a vendor's AI chatbot handling PHI on a patient portal is a business associate, so the practice or hospital needs a business associate agreement first.

Applies to: HIPAA covered entities and business associates

Proposed rule binding HIPAA covered entities and business associates: asset inventory, network map, ePHI encryption and multifactor authentication, with ePHI in AI training data protected.

Applies to: Anyone who makes an AI chatbot publicly available to consumers

Would bind anyone who makes an AI chatbot publicly available to consumers, which reaches a practice's or hospital's patient-facing chatbot.

Applies to: Oregon Medical Board licensees

Oregon Medical Board statement that holds its licensees responsible for AI-assisted care and sets expectations for their AI use; it does not address practices or hospitals as entities.

Applies to: Medicare Advantage organizations

Binds Medicare Advantage plans only: medical necessity decisions rest on the enrollee's own circumstances, and a qualified professional reviews adverse decisions before issue.

Applies to: Medicare Advantage organizations and Medicare-Medicaid Plans

Applies to Medicare Advantage organizations and Medicare-Medicaid Plans only: AI alone may not deny an admission, downgrade to observation or end post-acute care, and decisions rest on the patient's own circumstances.

Applies to: Physicians and other practitioners billing the Medicare physician fee schedule

Fee schedule codes G0552 to G0554 let clinicians bill for FDA-cleared digital mental health treatment devices; a payment option, not a duty.

Applies to: Medicare Advantage organizations, state Medicaid and CHIP fee-for-service programs, Medicaid managed care plans, CHIP managed care entities and qualified health plan issuers on the federally facilitated Exchanges

Binds MA, Medicaid, CHIP and Exchange payers only: prior authorization deadlines, specific denial reasons and a prior authorization API; no AI rule, listed for prior authorization.

Applies to: Hospitals paid under the Medicare inpatient prospective payment system

Inpatient new technology add-on payments for approved AI tools; a payment change for hospitals, not a duty.

Applies to: Hospital outpatient departments paid under the Medicare outpatient prospective payment system

Proposed outpatient payment for 36 designated software analysis services in hospital outpatient departments; a payment change, not a duty.

Applies to: Physicians and other practitioners paid under the Medicare physician fee schedule

Proposed fee schedule pricing for 10 software analysis codes, paid to whoever bills the fee schedule; a payment change, not a duty.

Applies to: Medicare Advantage organizations; CMS and ONC for a report to Congress

Would bind Medicare Advantage plans only: electronic prior authorization and annual reports on requests approved or denied with AI or other decision technology.

Applies to: HHS (rulemaking); entities that process identifiable health information outside HIPAA's protections for protected health information, including data brokers; HIPAA covered entities for the AI-related minimum necessary rules

Would direct HHS to write rules on how the minimum necessary standard applies to PHI used for AI; covered entities would be bound only through those future rules, so it affects them.