
642 P.2d 696 (1982)
56 Or.App. 559
Guy L. BRASEL and Vanessa M. Brasel, Individually and Guy L. Brasel and Vanessa M. Brasel, As Co-Personal Representatives of the Estate of Desha M. Brasel, Deceased, Appellants,
v.
CHILDREN's SERVICES DIVISION, an Agency of the State of Oregon, Respondent.
No. 40-302; CA 19981.
Court of Appeals of Oregon.
Argued and Submitted September 25, 1981.
Decided March 22, 1982.
*697 Michael J. McElligott, Hillsboro, argued the cause and filed the brief for appellants.
Rudolph S. Westerband, Asst. Atty. Gen., Salem, argued the cause for respondent. With him on the brief were Dave Frohnmayer, Atty. Gen. and William F. Gary, Sol. Gen., Salem.
Before GILLETTE, P.J., YOUNG, J., and ROBERTS, J. Pro Tem.
ROBERTS, Judge Pro Tem.
This is a wrongful death action brought by the parents of an 18-month-old girl who died as a result of injuries suffered in a day care center certified by the Children's Services Division (CSD). Plaintiffs appeal from the court's order dismissing their second amended complaint for failure to state a cause of action and from the granting of motions to strike certain of the allegations in their original complaint. We reverse and remand for trial.
Plaintiffs alleged negligence on the part of defendant in (1) failing to properly investigate the day care facility in which their daughter was injured before issuing a certificate of approval for its operation pursuant to ORS 418.810; (2) failing to investigate an incident of child abuse alleged to have occurred at the facility before plaintiffs placed their daughter there; (3) failing to halt operation of the center following the incident; (4) failing to inform plaintiffs of a previous incident; and (5) allowing them to rely upon representations that the day care facility was a safe and secure place for their child when defendant knew that it was not.[1] Defendant moved to dismiss on the ground that CSD's actions were discretionary and that the state was therefore immune from liability under ORS 30.265. The initial motion to dismiss was denied, but the court granted defendant's alternative motion to strike all but one of plaintiffs' claims on the grounds of immunity or that the claims were sham, frivolous and irrelevant, and its motion to make more definite and certain the allegation that defendant represented to plaintiffs that the day care facility was safe. Plaintiffs filed an amended complaint on the latter point; defendant moved against it for failure to state a claim; and the motion to dismiss was granted. Plaintiffs filed their second amended complaint, which was dismissed with prejudice, defendant arguing that it was virtually identical to the complaint which had already been dismissed.
ORS 30.265(3) provides, in pertinent part:
"(3) Every public body and its officers, employes and agents acting within the scope of their employment or duties are immune from liability for:
"* * *
"(c) Any claim based upon the performance of or the failure to exercise or perform a discretionary function or duty, whether or not the discretion is abused.
The initial question raised by this case is whether it can be said as a matter of law that the acts of CSD in issuing and overseeing a certificate of approval for a day care facility are "discretionary" acts immune *698 from liability under the Oregon Tort Claims Act.
In Stevenson v. State of Oregon, 290 Or. 3, 619 P.2d 247 (1980), the Supreme Court noted that the traditional distinctions between the discretionary acts of a highway department, i.e., planning and design, and the non-discretionary acts, i.e., maintenance, "involve the exercise of two very different kinds of judgment." 290 Or. at 9, 619 P.2d 247. Acts of governmental discretion, the court said, are acts which involve policy judgment, for instance, the decision to build a highway rather than a railroad track. These, it said, are the kind of acts for which the legislature intended tort immunity. 290 Or. at 10, 619 P.2d 247. On the other hand, the court said, acts which do not involve the making of public policy, but which perhaps also involve the use of "discretion" in the sense that a choice must be made, are insulated from liability only if they actually involve exercise of policy judgment. 290 Or. at 14, 619 P.2d 247. The burden is on the state to establish its immunity, either by (1) the nature of the function, or (2) evidence of how the decision was made. 290 Or. at 15, 619 P.2d 247. The second requirement has been interpreted to mean a showing that discretion was actually exercised in making the decision which is challenged. Bradford v. Davis, 290 Or. 855, 865, 626 P.2d 1376 (1981); accord, Johnson v. State, 69 Cal.2d 782, 73 Cal. Rptr. 240, 447 P.2d 352 (1968).
In Brennen v. City of Eugene, 285 Or. 401, 591 P.2d 719 (1979), the city was held liable for issuing a taxicab license without first determining whether the operator had satisfied a requirement of the city licensing ordinance that he carry a minimum level of insurance. The city's decision to require a specific level of insurance was termed in Bradford "a discretionary policy choice of the city," but failure to determine compliance with that requirement, it said, was not discretionary. 290 Or. at 865, 626 P.2d 1376. Similarly, in Dizick v. Umpqua Community College, 287 Or. 303, 599 P.2d 444 (1979), the Supreme Court held that, while a college has discretion in design of, and acquisition of equipment for, a course program, representatives of the college were not immune from liability when they misled a prospective student as to the course materials and equipment available.
It is clear from these cases that the state enjoys immunity from tort liability when it makes a policy decision that its agency, CSD, shall have responsibility for certifying that private day care facilities operating in the state meet certain standards of health and safety. It also appears that CSD itself makes a policy decision when it establishes by rule what the criteria for issuance of a certificate of approval shall be. The division's action in adopting those standards may be immune from tort liability as a discretionary policy-making act, but at issue here is the process by which these standards were applied in the licensing of this particular facility. Without knowing more about the actual process by which the decision was made to license the day care facility where plaintiffs' daughter was injured, and without knowing how, and by whom, any subsequent decision not to halt operation was made, it cannot be said that the decisions were ones involving the making of policy, for which defendant enjoys immunity. That will have to be demonstrated by the evidence.
A law review article dealing with the California case of Johnson v. State, supra (which held the state was not immune from liability for personal injuries suffered by a foster parent as a result of the state Youth Authority's placement in her home of a youth with a background of violence without informing her of his dangerous propensities), has noted that, under the rule adopted in that case (and adopted by the Supreme Court in Stevenson v. State of Oregon, supra), "[s]ince the state must affirmatively prove that discretion was exercised in fact, few cases can be disposed of on demurrer by the governmental entity." Selmi, Discretionary Immunity in California in the Aftermath of Johnson v. State, 15 Santa Clara Law 454, 463 (1975). In addition, Brennen is clearly contra defendant's position in holding that, when criteria for issuance *699 of a license have been set, negligent failure by a government agent to determine that an application satisfies the license requirements is actionable.
We conclude, therefore, that the state may not, in this case, establish its claim of discretionary authority at the pleading stage. On appeal, however, defendant raises additional challenges to the pleadings, claiming that certain allegations of negligence should be stricken because plaintiffs failed to plead facts to indicate that (1) defendant knew or should have known that the requirements for the certificate were not met, and (2) had an investigation of the previously reported child abuse been conducted, it would have resulted in a finding of "conditions which seriously endangered the well-being of children," for which the CSD rules mandate immediate suspension of the facility's certificate. Failure of a complaint to state facts sufficient to constitute a claim may be raised at trial or on appeal. Pickinpaugh v. Morton, 268 Or. 9, 519 P.2d 91 (1974); Prevosky v. Fireman's Fund Ins. Co., 262 Or. 435, 499 P.2d 339 (1972); see ORCP 21.
As to the first point, having to do with certificate requirements, defendant claims plaintiffs fail to plead a breach of duty. We disagree. CSD's duty to plaintiffs as prospective users of a state-certified day care facility arises statutorily, from ORS 418.805 et seq, which place in CSD the authority to establish health and safety standards for day care centers and to ensure complaince by inspection and investigation. By alleging that defendant issued a certificate to a center which did not meet these qualifications, and that plaintiffs subsequently entrusted their daughter to that center, plaintiffs have sufficiently alleged both a duty owed to them as members of the protected class and a breach of that duty.
The second point, having to do with the investigation of a reported incident of child abuse, goes to the issue of causation. Defendant argues that plaintiffs must make a claim that if the alleged child abuse had been investigated, it would have led to a closure of the facility, i.e., uncovered conditions sufficiently harmful to mandate immediate suspension under CSD rules. On this issue, plaintiffs plead that as a result of defendant's "failing to investigate the reported child abuse which occurred in the said day care facility * * *" their daughter was injured. We think this specification, taken in conjunction with other well-pleaded matters, alleges duty, breach and causation with sufficient specificity to state a claim of negligence.
The remaining issue is the confidentiality of the child abuse report itself. Plaintiffs allege that defendant was negligent in failing to inform them of a prior incident; defendant, while it contends on appeal that this is simply a repetition of the argument that the certificate should have been suspended because of this report, was successful in its argument at trial that it was forbidden to disclose the existence of the child abuse report by ORS 418.770 and ORS 418.990(7).[2] We agree that ORS 418.770(3) forbids public access to reports and records of child abuse. We take it to forbid as well publication to prospective users of *700 a certified day care facility the fact that a report involving the facility had been made. CSD's duty, in regard to reports of child abuse, is to investigate and to take appropriate action to protect the children; it is not authorized to advise parents of reports of child abuse. It follows that CSD had no duty to disclose the report.
The judgment of the trial court dismissing plaintiffs' complaint is reversed and remanded. Its order granting defendant's motion to strike the allegations having to do with issuance of and failure to suspend the CSD certificate, the allegations relating to defendant's failure to investigate the report of child abuse, and the allegation having to do with defendant's representations that the facility was safe is also reversed. The order granting the motion to strike is affirmed as to the allegations relating to defendant's failure to disclose the child abuse report to plaintiffs.[3]
NOTES
[1]  Plaintiffs do not allege wilful misrepresentation.
[2]  ORS 418.770, in pertinent part, provides:

"(1) Notwithstanding the provisions of ORS 192.001 to 192.500 and 192.610 to 192.990 relating to confidentiality and accessibility for public inspection of public records and public documents, reports and records compiled under the provisions of ORS 418.750 to 418.762 are confidential and are not accessible for public inspection. However, the Children's Services Division shall make records available to any law enforcement agency or a child abuse registry in any other state for the purpose of subsequent investigation of child abuse, and to any physician, at his request, regarding any child brought to him or coming before him for examination, care or treatment.
"* * *
"(3) No officer or employe of the Children's Services Division, any social service agency, any law enforcement agency or any physician shall release any information not authorized by subsection (1) of this section."
ORS 418.990(7) provides:
"A person who violates subsection (3) of ORS 418.770 commits a violation punishable by a fine not exceeding $1,000."
[3]  Plaintiffs do not appeal dismissal of their allegation dealing with Health Division inspections.
