Ohio Revised Code Search

...to 3797.10 of the Revised Code or under rules adopted under authority of those sections: (1) The attorney general, a deputy, officer, or employee of the office of the attorney general, a sheriff, or a deputy, officer, or employee of the office of the sheriff; (2) A prosecutor and an officer or employee of the office of a prosecutor; (3) A person identified in division (A)(2), (3), (4), (5), (6), or (7) of secti...

... of age who meets criteria specified in rules adopted by the medicaid director under section 3798.13 of the Revised Code. (J) "More stringent" has the same meaning as in 45 C.F.R. 160.202. (K) "Personal representative" means a person who has authority under applicable law to make decisions related to health care on behalf of an adult or emancipated minor, or the parent, legal guardian, or other person acting in...

...It is the intent of the general assembly in enacting this chapter to make the laws of this state governing the use and disclosure of protected health information by covered entities consistent with, but generally not more stringent than, the HIPAA privacy rule for the purpose of eliminating barriers to the adoption and use of electronic health records and health information exchanges. Therefore, it is also the ...

...(A) Subject to division (B) of this section, a covered entity shall do both of the following: (1) If an individual's protected health information is maintained by the covered entity in a designated record set, provide the individual or the individual's personal representative with access to that information in a manner consistent with 45 C.F.R. 164.524; (2) Implement and maintain appropriate administrative, ...

...A covered entity shall not do either of the following: (A) Use or disclose protected health information without an authorization that is valid under 45 C.F.R. 164.508 and, if applicable, 42 C.F.R. part 2, except when the use or disclosure is required or permitted without such authorization by Subchapter C of Subtitle A of Title 45 of the Code of Federal Regulations and, if applicable, 42 C.F.R. part 2; (B) U...

...at govern the confidentiality, privacy, security, or privileged status of protected health information in the possession or custody of an agency as defined in section 111.15 of the Revised Code; govern the process for obtaining from a patient consent to the provision of health care or consent for participation in medical or other scientific research; govern the process for determining whether an adult has a physical ...

...he medicaid director shall prescribe by rules adopted in accordance with Chapter 119. of the Revised Code a standard authorization form for the use and disclosure of protected health information by covered entities in this state. The form shall meet all requirements specified in 45 C.F.R. 164.508 and, where applicable, 42 C.F.R. part 2. (B) If a form the medicaid director prescribes under division (A) of this secti...

...ining to the confidentiality, privacy, security, or privileged status of protected health information transacted, maintained in, or accessed through a health information exchange is unenforceable if it conflicts with this chapter: (1) A section of the Revised Code that is not in this chapter; (2) A rule as defined in section 119.01 of the Revised Code; (3) An internal management rule as defined in section 111...

...The medicaid director shall adopt rules for purposes of specifying the criteria a person who is mentally or physically disabled and who is under twenty-one years of age must meet to be considered a minor for purposes of sections 3798.07 and 3798.12 of the Revised Code.

...the Commission 1. To adopt bylaws and rules pursuant to Articles V and VI of the compact, which shall have the force and effect of law and shall be binding in the compacting states to the extent and in the manner provided in the compact; 2. To receive and review in an expeditious manner treatments and therapeutic protocols for the cure of disease submitted to the commission and to award prizes for submissions tha...

...nt, and certificate holder. (E) "Cybersecurity event" means an event resulting in unauthorized access to, disruption of, or misuse of an information system or nonpublic information stored on an information system that has a reasonable likelihood of materially harming any consumer residing in this state or any material part of the normal operations of the licensee. "Cybersecurity event" does not include the unauthor...

...ain a comprehensive written information security program based on the licensee's risk assessment. The program shall be commensurate with the size and complexity of the licensee, the nature and scope of the licensee's activities including its use of third-party service providers, and the sensitivity of the nonpublic information used by the licensee or in the licensee's possession, custody, or control. (B) The inform...

...(A) If a licensee learns that a cybersecurity event has or may have occurred, the licensee or an outside vendor or service provider designated to act on behalf of the licensee shall conduct a prompt investigation. (B) During the investigation, the licensee or an outside vendor or service provider designated to act on behalf of the licensee shall, at a minimum, do as much of the following as possible: (1) Determin...

...sible after a determination that a cybersecurity event involving nonpublic information in the possession of the licensee has occurred, but in no event later than three business days after that determination, when either of the following criteria has been met: (1) Both of the following apply: (a) This state is the licensee's state of domicile, in the case of an insurer, or this state is the licensee's home state, ...

...(A) The superintendent of insurance shall have power to examine and investigate into the affairs of any licensee to determine whether the licensee has been or is engaged in any conduct in violation of this chapter. This power is in addition to the powers that the superintendent has under Title XXXIX and Chapters 1739. and 1751. of the Revised Code. (B) Whenever the superintendent has reason to believe that a licens...

...(A)(1) Any documents, materials, or other information in the control or possession of the department of insurance that are furnished pursuant to divisions (H)(1) and (I) of section 3965.02 and divisions (B)(1)(b), (c), (d), (e), (h), (j), and (k) of section 3965.04 of the Revised Code, or that are obtained by, created by, or disclosed to the superintendent of insurance in an investigation or examination pursuant to s...

...yee, agent, representative, independent contractor, or designee of a licensee, who is also a licensee, is exempt from section 3965.02 of the Revised Code and need not develop its own information security program to the extent that the employee, agent, representative, independent contractor, or designee is covered by the information security program of the other licensee. (D) If a licensee ceases to qualify for an e...

...ure to implement reasonable information security controls resulted in a data breach concerning nonpublic information. (B) The affirmative defenses permitted under this section shall not limit any other affirmative defenses available to a licensee.

... applicable to licensees regarding cybersecurity events, the security of nonpublic information, data security, investigation of cybersecurity events, and notification to the superintendent of cybersecurity events.

...ter 119. of the Revised Code, may adopt rules as necessary to carry out the provisions of this chapter.

...administering this chapter and adopting rules pursuant to this chapter.

...the protection of the public health and safety and shall include rules establishing the safe working pressure to be carried by any such systems; a program for the certification of the welding and brazing procedures proposed to be used on any such system by the owner or operator of any welding or brazing business and for quinquennial performance testing of welders and brazers who work on any such system; and measures ...

...quenters thereof, shall furnish and use safety devices and safeguards, shall adopt and use methods and processes, follow and obey orders, and prescribe hours of labor reasonably adequate to render such employment and places of employment safe, and shall do every other thing reasonably necessary to protect the life, health, safety, and welfare of such employees and frequenters.

...shall fail to furnish, provide, and use safety devices and safeguards, or fail to obey and follow orders or to adopt and use methods and processes reasonably adequate to render such employment and place of employment safe. No employer shall fail to do every other thing reasonably necessary to protect the life, health, safety, and welfare of such employees or frequenters. No such employer or other person shall constru...

...lace, damage, destroy, or carry off any safety device or safeguard furnished or provided for use in any employment or place of employment, or interfere in any way with the use thereof by any other person. No employee shall interfere with the use of any method or process adopted for the protection of any employee in such employment or place of employment, or frequenter of such place of employment, or fail to follow an...