Oregon Revised Statutes Public Health and Safety § 442.430

(1) Whenever a further investigation is considered necessary or desirable by the Oregon Health Authority to verify the accuracy of the information in the reports made by health care facilities, the authority may make any necessary further examination of the facility's records and accounts. Such further examinations include, but are not limited to, requiring a full or partial audit of all such records and accounts.

(2) In carrying out the duties prescribed by ORS 442.400 to 442.463, the authority may utilize its own staff or may contract with any appropriate, independent, qualified third party. No such contractor shall release or publish or otherwise use any information made available to it under its contractual responsibility unless such permission is specifically granted by the authority.