The following words and terms, when used in this Subchapter shall have the following meanings, unless the context clearly indicates otherwise:

     "Authorization" means a document that contains:

• (A) the name or other specific identification of the person(s), or class of persons, authorized to make the requested use or disclosure;
• (B) the name or other specific identification of the person(s), or class of persons, to whom Oklahoma Department of Human Services (OKDHS) may make the requested use or disclosure;
• (C) a description of each purpose of the requested use or disclosure.  The statement "at the request of the individual" is a sufficient description of the purpose when an individual initiates the authorization and does not, or elects not to, provide a statement of the purpose;
• (D) an expiration date or an expiration event that relates to the individual or the purpose of the use or disclosure.  The statement "end of the research study," "none," or similar language is sufficient if the authorization is for a use or disclosure of protected health information (PHI) for research, including for the creation and maintenance of a research database or research repository;
• (E) the signature of the individual and date.  If the authorization is signed by a personal representative of the individual, a description of the representative's authority to act for the individual must also be provided; and
• (F) the individual's right to revoke the authorization in writing.

     "Disclosure" means the release of PHI to another entity or individual.

     "Health care operations" means certain administrative, financial, legal, and quality improvement activities that are necessary to run the organization and to support the core functions of treatment and payment.  Some common activities include quality assessment activities, case management, care coordination, and fraud and abuse investigation.

     "Payment" means the various activities of health care providers to obtain payment or be reimbursed for their services.  Some common activities include determining eligibility for a plan, adjudicating claims, risk adjustments, billing and collecting activities, medical necessity reviews, and utilization reviews.

     "Personal representative" means an individual who:

• (A) is a parent, legal guardian, or legal custodian appointed by a court;
• (B) has the authority to act on behalf of a deceased individual or his or her estate;
• (C) has been given authority to act on behalf of an individual with regard to health care through a power of attorney, medical directive, or guardianship; or
• (D) has been designated by an adult as his or her personal representative with regard to health care.  A personal representative is treated the same as the client.

     "Privacy notice" means a form that notifies an individual:

• (A) how his or her health information is handled by OKDHS; and
• (B) what his or her rights are regarding PHI.

     "Protected health information (PHI)" means any health-related information that is used to individually identify a person by virtue of its containing one or more individual identifiers, such as name, Social Security number, telephone number, case number, or postal zip code, and applies to information transmitted or maintained in any form or medium, including electronic, paper, or oral.

     "Treatment" means the provision, coordination, or management of health care and related services.  This includes consultation between health care providers regarding a client or the referral of a client from one health care provider to another.

     "Treatment, payment, operations (TPO)" means routine uses and disclosures of PHI.

     "Use" means, with respect to PHI, the sharing, employment, application, utilization, examination, or analysis of such information within an entity that maintains such information.