Impact Privacy Policy

Comments

  • When visitors leave comments on our site, we collect the data shown in the comments form, along with the visitor’s IP address and browser user agent string to help with spam detection.

  • An anonymized string created from your email address (a “hash”) may be provided to the Gravatar service to verify use. The Gravatar privacy policy is available here: https://automattic.com/privacy/

  • After approval of your comment, your profile picture is visible to the public in the context of your comment.

Media

  • If you upload images to our website, avoid uploading images with embedded location data (EXIF GPS). Visitors may download and extract location data from such images.

Cookies

  • If you leave a comment, you may opt to save your name, email address, and website in cookies for convenience. These last for one year.

  • A temporary cookie is created on our login page to test browser cookie support; it is deleted when you close your browser.

  • Login cookies last for two days, and screen option cookies last for one year. If you select “Remember Me,” your login will persist for two weeks.

  • Logging out removes login cookies. Editing or publishing an article will place an additional cookie that expires after one day.

Embedded Content from Other Websites

  • Articles on this site may include embedded content (e.g., videos, images, articles). Embedded content behaves as if you visited the external site directly. These websites may collect data, use cookies, embed additional third-party tracking, and monitor your interaction.

Who We Share Your Data With

  • If you request a password reset, your IP address will be included in the reset email.

  • Mobile opt-in, SMS consent, and phone numbers collected for SMS communication purposes will not be shared with any third party or affiliates for marketing purposes.

How Long We Retain Your Data

  • Comments and their metadata are retained indefinitely.

  • Registered user accounts (if any) store personal information provided in their profile. Users may edit or delete their information at any time (except their username). Administrators can also view and edit this information.

Your Rights Over Your Data

  • If you have an account or have left comments, you may request an exported file of the personal data we hold about you, including any you provided. You may also request deletion of your data, except where we must retain it for administrative, legal, or compliance purposes.

Where Your Data Is Sent

  • Visitor comments may be checked through an automated spam detection service.

Mobile Opt-in

  • Mobile opt-in, SMS consent and phone numbers will not be shared with third parties and affiliates for marketing purposes. 

SMS / Text Messaging Terms & Conditions / Consent

  • Mobile opt-in, SMS consent, and phone numbers will not be shared with third parties and affiliates for marketing purposes

Types of SMS Messages

  • If you have consented to receive text messages from IMPACT of Oregon, you may receive messages related to the following: Conversational (Internal & external)

Message Frequency

  • Message frequency may vary depending on the type of communication.

Standard Message Fees

  • Please note that standard message and data rates may apply, depending on your carrier’s pricing plan. These fees may vary if the message is sent domestically or internationally.

Opt-In Methods

  • You may opt-in to receive SMS messages from IMPACT of Oregon in the following ways: Verbally. 

Opt-Out Instructions

  • You can opt out of receiving SMS messages at any time. To do so, simply reply "STOP" to any SMS message you receive. Alternatively, you can contact us directly to request removal from our messaging list.

Help

  • If you are experiencing any issues, you can reply with the keyword HELP. Or, you can get help directly from us at  503.523.5605

Standard Disclosures

NOTICE OF PRIVACY PRACTICES

  • This Notice describes how personal health information about you may be used and disclosed and how you can access that information. Please review it carefully.

Who We Are and Our Legal Duties

  • This Notice applies to Impact of Oregon (referred to as “we,” “our,” or “the Agency”) and our entire workforce, including all Direct Support Professionals (DSPs), County Managers,  Administrative Staff, and other employees.

  • Impact of Oregon is a Standard Model Agency providing support services to individuals with intellectual and developmental disabilities (IDD) under the Oregon Department of Human Services (ODDS).

  • We are required by law to:

  • Maintain the privacy and security of your Protected Health Information (PHI).

  • Provide you with this Notice outlining our legal duties and privacy practices.

  • Notify you if a breach occurs that may have compromised the privacy or security of your information.

  • Follow the terms of this Notice currently in effect.

Your Rights Regarding Your Health Information

  • You have the following rights regarding PHI that we maintain about you:

Inspect and Copy: 

  • You may request to review or obtain copies of your PHI maintained by the Agency. We may charge a reasonable, cost-based fee for copies.

Request an Amendment:

  • If you believe information about you is incorrect or incomplete, you may request an amendment. If denied, you will receive a written explanation.

Accounting of Disclosures:

  • You may request a list of certain disclosures we have made of your PHI, other than those for treatment, payment, or agency operations.

Request Restrictions:

  • You may ask us to restrict the use or disclosure of your PHI for treatment, payment, or operations. We are not required to agree, except where law requires us to honor your restriction.

Confidential Communications:

  • You may request that we communicate with you in a specific way (for example, by mail only or at a certain address).

Paper Copy:

  • You may request a paper copy of this Notice at any time, even if you have agreed to receive it electronically.

  • Requests related to your PHI can be made by contacting Impact of Oregon’s Office Manager at office@impact-or.org 

How We May Use and Disclose Your PHI

  • We may use and disclose PHI without your written authorization for the following purposes permitted by law:

Treatment

  • We may use and share PHI with your case management entity, healthcare providers, or others involved in coordinating your services and supports.
    Example: sharing support plans or relevant information with your County Services Coordinator or healthcare provider to ensure continuity of care.

Payment

  • We may use and disclose PHI to obtain authorization, verify eligibility, or receive payment for the services we provide through Medicaid or other funding sources.

Agency Operations

  • We may use PHI for internal operations that help us maintain quality services, ensure compliance with OAR 411 requirements, and train staff.
    Example: reviewing documentation for quality assurance, compliance audits, or performance improvement activities.

Business Associates

  • We may share PHI with approved third-party vendors who perform functions on our behalf (such as payroll processors, electronic record systems, or training platforms).
    All Business Associates are required by law and contract (Business Associate Agreements) to safeguard your information.

Other Permitted or Required Disclosures

  • We may also disclose PHI without authorization in certain circumstances, including:

As Required by Law:

  • For audits, investigations, inspections, or to comply with ODHS, Medicaid, or other oversight entities.

Public Health and Safety:

  • To prevent or control disease, injury, or disability.

Judicial and Administrative Proceedings:

  • In response to lawful court orders or administrative requests.

Law Enforcement:

  • To comply with lawful requests for information from law enforcement when required.

Workers’ Compensation:

  • To comply with applicable workers’ compensation or similar laws.

Serious Threats:

  • To prevent or lessen a serious and imminent threat to health or safety.

Government Oversight:

  • To regulatory agencies such as the Office for Civil Rights or ODHS for compliance purposes.

Uses and Disclosures Requiring Your Written Authorization

  • Any use or disclosure of your PHI not covered by this Notice or permitted by law will require your written authorization.
    This includes (but is not limited to):

  • Marketing activities not related to Impact of Oregon’s operations.

  • Sale of PHI.

  • Disclosure of psychotherapy notes (if maintained).

  • You may revoke an authorization at any time in writing, except where we have already relied on it.