Oregon Revised Statutes Insurance § 746.630

(1) Notwithstanding any other law of this state, a licensee or insurance-support organization may not use as its disclosure authorization form in connection with insurance transactions a form or statement that authorizes the disclosure of personal or privileged information about an individual to the licensee or insurance-support organization unless the form or statement is clear and conspicuous, and contains all of the following:

(2) An authorization is not valid for more than 24 months.

(3) An individual who is the subject of personal information may revoke an authorization provided pursuant to this section at any time, subject to the rights of any individual who acted in reliance on the authorization prior to notice of the revocation.

(4) A licensee must retain the authorization of an individual or a copy thereof in the record of the individual who is the subject of the personal information.

(5) A disclosure authorization obtained by an insurer, insurance producer or insurance-support organization from an individual prior to January 1, 1983, is considered to be in compliance with this section.