Oregon Revised Statutes Public Health and Safety § 433.098

(1) An authorized user and the employees or agents of an authorized user are not liable for sharing or using information from the immunization registry regarding a client's immunization record or tracking and recall record as provided in ORS 433.094.

(2) Information in an immunization registry regarding a client's immunization record or tracking and recall record, or derived from the registry or record, is confidential and may not be disclosed to any person who is not specifically authorized to receive information under ORS 433.090 to 433.102.

(3) When a client who is 18 years of age or older requests in writing that the client's immunization record be removed from an immunization registry, the agency that maintains the registry shall purge the client's immunization record from the registry as soon as is reasonably possible.

(4) Before sharing data with any immunization registry, an immunization registry maintained in Oregon shall ensure that the immunization registry receiving the data has confidentiality and security policies at least as stringent as the policies of the registry sharing the data.