Processes personal data, in Rhode Island

R.I. Gen. Laws secs. 27-19-44(b), 27-20-39(b), 27-41-53(b) · Read the law's page

• As a nonprofit health service corporation, nonprofit health insurer or health maintenance organization, do not use a genetic test, a request for a genetic test or the results of a genetic test to reject, deny, limit, cancel, refuse to renew, increase the rates of, affect the terms or conditions of, or otherwise affect a group or individual health insurance policy, contract or plan (sections 27-19-44(b)(1), 27-20-39(b)(1) and 27-41-53(b)(1)).
• Do not request or require a genetic test to decide whether to issue or renew health benefits coverage, to set reimbursement or copay levels, or to determine covered benefits and services (sections 27-19-44(b)(2), 27-20-39(b)(2) and 27-41-53(b)(2)).
• Do not release the results of a genetic test without the individual's prior written authorization, except in a format with individual identifiers removed, encrypted or encoded; a recipient may use or disclose the information only to carry out the purpose for which it was disclosed, and each redisclosure needs authorization (sections 27-19-44(b)(3), 27-20-39(b)(3) and 27-41-53(b)(3)).
• Do not request or require information as to whether an individual has ever had a genetic test or participated in genetic testing of any kind, whether for clinical or research purposes (sections 27-19-44(b)(4), 27-20-39(b)(4) and 27-41-53(b)(4)).

R.I. Gen. Laws sec. 27-18-52(b) · Read the law's page

• Under an individual or group health insurance contract, plan or policy that you deliver, issue for delivery or renew in Rhode Island and that provides medical coverage including physician services in a physician's office, or any major medical or comprehensive-type policy (excluding disability income, long-term care and supplemental policies), do not use a genetic test, a request for genetic tests or the results of a genetic test to reject, deny, limit, cancel, refuse to renew, increase the rates of or otherwise affect the policy (section 27-18-52(b)(1)).
• Do not request or require a genetic test to decide whether to issue or renew an individual's health benefits coverage, to set reimbursement or copay levels, or to determine covered benefits and services (section 27-18-52(b)(2)).
• Do not release the results of a genetic test without the individual's prior written authorization, except in a format with individual identifiers removed, encrypted or encoded; a recipient may use or disclose the information only to carry out the purpose for which it was disclosed, and each redisclosure needs authorization (section 27-18-52(b)(3)).
• Do not request or require information as to whether an individual has ever had a genetic test or participated in genetic testing of any kind, whether for clinical or research purposes (section 27-18-52(b)(4)).

R.I. Gen. Laws secs. 27-18-52(a), 27-18-52.1(a), 27-19-44(a), 27-19-44.1(a), 27-20-39(a), 27-20-39.1(a), 27-41-53(a), 27-41-53.1(a) · Read the law's page

• As an insurance administrator, health plan or provider, do not release genetic information without the individual's prior written authorization, required for each disclosure and stating to whom the disclosure is made; research settings governed by the Common Rule are excepted (subsection (a) of sections 27-18-52, 27-18-52.1, 27-19-44, 27-19-44.1, 27-20-39, 27-20-39.1, 27-41-53 and 27-41-53.1).

R.I. Gen. Laws secs. 27-18-52.1(b), 27-19-44.1(b), 27-20-39.1(b), 27-41-53.1(b) · Read the law's page

• Under an individual or group health insurance contract, plan or policy that you deliver, issue for delivery or renew in Rhode Island and that provides medical coverage including physician services in a physician's office, or any major medical or comprehensive-type policy (excluding disability income, long-term care and supplemental policies), do not use genetic information or a request for it to reject, deny, limit, cancel, refuse to renew, increase the rates of or otherwise affect the policy (subsection (b)(1) of sections 27-18-52.1, 27-19-44.1, 27-20-39.1 and 27-41-53.1).
• Do not request or require genetic information to decide whether to issue or renew an individual's health benefits coverage, to set reimbursement or copay levels, or to determine covered benefits and services (subsection (b)(2) of those sections).
• Do not release genetic information without the individual's prior written authorization, except in a format with individual identifiers removed, encrypted or encoded; a recipient may use or disclose it only to carry out the purpose for which it was disclosed, and each redisclosure needs authorization (subsection (b)(3) of those sections).
• Do not request or require information as to whether an individual has genetic information, whether for clinical or research purposes (subsection (b)(4) of those sections).

R.I. Gen. Laws sec. 6-13-19 · Read the law's page

• If you offer discount cards for purchases made at any business you maintain, do not require a consumer of goods who applies for a discount card to furnish all or part of a social security number as a condition precedent to the application.
• Do not sell or give information obtained on a discount card application, or by use of a discount card, to any other person, firm, corporation or business entity, except that you may disclose it to your affiliates, to service providers that perform services for you, or as required by law, and may transfer it in connection with the sale of your business operations.

R.I. Gen. Laws secs. 6-48-7, 6-48-8 · Read the law's page

• Do not intentionally communicate or otherwise make available to the general public all or part of an individual's social security number (section 6-48-8(a)(1)).
• Do not print all or part of an individual's social security number on any card the individual must use to access the products or services you provide (section 6-48-8(a)(2)).
• Do not require an individual to transmit all or part of a social security number over the Internet unless the connection is secure or the number is encrypted, and do not require an individual to use all or part of one to access an Internet website unless a password, unique personal identification number or other authentication device is also required (section 6-48-8(a)(3) and (4)).
• Do not print all or part of an individual's social security number on materials mailed to the individual unless state or federal law requires it; a number that may be mailed, such as one on an application or enrollment form, may not be printed on a postcard or other mailer not requiring an envelope, or be visible on the envelope or without opening it (section 6-48-8(a)(5)).

R.I. Gen. Laws sec. 23-17.17-10(a), (b) · Read the law's page

• Remove all personal identifiers from the data you submit to the director under chapter 17.17 of title 23; if you are an insurer, assign to each subscriber record a unique identifier not linked to any personally identifiable information (R.I. Gen. Laws sec. 23-17.17-10(b)).

R.I. Gen. Laws secs. 6-52-1 to 6-52-4 · Read the law's page

• Take reasonable steps to destroy, or arrange for the destruction of, a customer's personal information within your custody and control that you no longer retain, by shredding, erasing, or otherwise destroying or modifying it to make it unreadable or indecipherable through any means.
• Destroy the information to ensure the security and confidentiality of customer personal information, to protect against any reasonably foreseeable threats or hazards to its security or integrity, and to protect against unauthorized access to or use of it that could result in substantial harm or inconvenience to any customer.
• This binds a business: any sole proprietorship, partnership, corporation, association, limited liability company or other group, however organized and whether or not organized to operate at a profit, including the state, a state agency or a political subdivision that destroys records. It does not bind a financial institution subject to the Gramm Leach Bliley Act and a listed federal regulator or the Department of Business Regulation, a health insurer, non-profit hospital, medical service corporation or health care facility subject to the privacy and security standards of the Health Insurance Portability and Accountability Act of 1996, a consumer report agency in compliance with the Federal Credit Reporting Act, or a business that contracts with another business to destroy the information and has physical evidence of that contract.

R.I. Gen. Laws ch. 6-48.1, secs. 6-48.1-2, 6-48.1-5, 6-48.1-6 · Read the law's page

• Determine whether you are a for-profit entity conducting business in Rhode Island, or targeting products or services to Rhode Island residents, that controlled or processed personal data of at least 35,000 customers, or 10,000 customers while deriving more than 20 percent of gross revenue from personal-data sales, before relying on any RIDTPPA exemption.

R.I. Gen. Laws sec. 6-48.1-7(a), (e) to (i) · Read the law's page

• Conduct and document a data protection assessment for each of your processing activities that presents a heightened risk of harm to a Rhode Island customer, including targeted advertising, the sale of personal data, profiling that presents a reasonably foreseeable risk of unfair treatment, injury, intrusion or other substantial injury, and the processing of sensitive data (R.I. Gen. Laws sec. 6-48.1-7(e)).
• Make a data protection assessment available to the attorney general when the attorney general requires its disclosure for an investigation (R.I. Gen. Laws sec. 6-48.1-7(f)).

R.I. Gen. Laws sec. 6-48.1-8 · Read the law's page

• Expect RIDTPPA violations to be enforced exclusively by the Rhode Island Attorney General, never by a private plaintiff.
• Do not rely on a notice-and-cure opportunity before an Attorney General action. Section 6-48.1-8 provides no cure period.
• Avoid intentionally disclosing personal data to a shell company or otherwise in violation of the chapter. Each such disclosure carries a fine of $100 to $500.

R.I. Gen. Laws secs. 6-48.1-2(13), 6-48.1-7(j), (n) · Read the law's page

• If you hold de-identified data, take reasonable measures to ensure that it cannot be associated with an individual (R.I. Gen. Laws sec. 6-48.1-7(j)(1)).
• Publicly commit to maintaining and using de-identified data without attempting to re-identify it (R.I. Gen. Laws sec. 6-48.1-7(j)(2)).
• Contractually obligate every recipient of de-identified data to comply with all provisions of the chapter, monitor their compliance with those commitments and take appropriate steps to address any breach of them (R.I. Gen. Laws sec. 6-48.1-7(j)(3) and (n)).

R.I. Gen. Laws secs. 6-48.1-5, 6-48.1-6 · Read the law's page

• Give a Rhode Island customer a means to confirm whether you process their personal data, access it, correct it, delete it, and receive a portable copy.
• Offer a Rhode Island customer an opt-out of targeted advertising, the sale of personal data, and significant-effect profiling.
• Respond to a customer rights request without undue delay and not later than 45 days after receipt, with one 45-day extension available, and decide an appeal within 60 days of receipt.

P.L. 2026, ch. 223 (Genetic Information Privacy Act), R.I. Gen. Laws secs. 6-63-1 to 6-63-7 · Read the law's page

• If you are a direct-to-consumer genetic testing company, give Rhode Island consumers a plain-language summary of your privacy practices and a prominent, easily accessible privacy notice covering your data collection, consent, use, access, disclosure, maintenance, transfer, security, retention and deletion practices and how to file a complaint alleging a violation of the chapter, plus a notice that deidentified genetic or phenotypic information may be shared with third parties for research (section 6-63-3(a)(1)).
• Obtain a consumer's express consent, in response to a clear, meaningful and prominent notice and never by inaction or through a dark pattern, before you collect, use or disclose their genetic data, and obtain separate and express consent for each use of the data collected through the product or service (including who has access to it, how it may be shared and the specific purposes), for storing the biological sample after the initial testing, for each use beyond the primary purpose and inherent contextual uses, for each transfer or disclosure to a third party other than a service provider (naming the third party), and for marketing, or facilitating marketing, based on the data (section 6-63-3(a)(2)).
• Give a consumer effective mechanisms, without unnecessary steps and at least one through your primary medium of communication, to revoke consent. Honor a revocation as soon as practicable and no later than 30 days after it, and destroy the biological sample within 30 days of receiving a revocation of consent to store it (section 6-63-3(a) and (b)).
• Implement and maintain reasonable security procedures and practices to protect a consumer's genetic data against unauthorized access, destruction, use, modification or disclosure (section 6-63-3(c)(1)).
• Develop procedures and practices that let a consumer easily access their genetic data, delete their account and genetic data (except data you must retain to comply with legal and regulatory requirements) and have their biological sample destroyed (section 6-63-3(c)(2)).
• Do not disclose a consumer's genetic data to an entity responsible for administering or making decisions about health insurance, life insurance, long-term care insurance, disability insurance or employment, or to an entity that advises one, unless section 6-63-3(e)(2) applies: the entity is not primarily engaged in those functions, receives the data in a different capacity, and bars any part of it that administers, advises on or decides those matters from accessing the data or sample.
• Do not discriminate against a consumer for exercising rights under the chapter, whether by denying goods, services or benefits, charging different prices or rates, providing a different level or quality, suggesting any of these, or treating the exercise of rights as a basis for suspicion of criminal wrongdoing or unlawful conduct. This duty binds a person or a public entity (section 6-63-3(d)).
• Contract with a service provider that collects, transports or analyzes a consumer's biological sample or genetic data for you so that it may not retain, use or disclose the sample, extracted genetic material, genetic data or any information about the consumer's identity for any purpose other than the contracted services, and may not associate or combine them with information it receives from or collects for others (section 6-63-2(10)).

R.I. Gen. Laws sec. 5-37.3-4(b)(3) · Read the law's page

• If you are qualified personnel who receive confidential healthcare information without patient consent for scientific research, management audits, financial audits, program evaluations, actuarial, insurance underwriting or similar studies, do not identify, directly or indirectly, any individual patient in any report of that research, audit or evaluation, and do not otherwise disclose patient identities in any manner (R.I. Gen. Laws sec. 5-37.3-4(b)(3)).

R.I. Gen. Laws sec. 6-13-17 · Read the law's page

• Unless federal law requires otherwise, do not require a consumer of goods or services to disclose all or part of a social security number incident to the sale of consumer goods or services, except that an insurance company or an institution licensed by the state or federal government for financial services may require applicants to disclose it, it may be required for providing and billing health care or pharmaceutical-related services, and it may be required as a condition of applying for a credit card (section 6-13-17(a)).

R.I. Gen. Laws secs. 11-49.3-2, 11-49.3-5 · Read the law's page

• Implement and maintain a risk-based information security program with reasonable security procedures and practices appropriate to your size and scope, the nature of the information, and the purpose for which it was collected, to protect the information from unauthorized access, use, modification, destruction, or disclosure and to preserve its confidentiality, integrity, and availability.
• Do not retain personal information longer than reasonably required to provide the requested services, meet the purpose for which it was collected, or comply with a written retention policy or a legal requirement; destroy it securely, for example by shredding, pulverization, incineration, or erasure, regardless of the medium it is stored in.
• If you disclose personal information about a Rhode Island resident to a nonaffiliated third party, require by written contract that the third party implement and maintain reasonable security procedures and practices of the same kind, appropriate to its own size and scope, the nature of the information, and the purpose for which it was collected.
• This binds a municipal agency, a state agency, or a person, defined broadly to include an individual, sole proprietorship, partnership, association, corporation, joint venture, business, legal entity, trust, estate, cooperative, or other commercial entity, that stores, collects, processes, maintains, acquires, uses, owns, or licenses personal information about a Rhode Island resident.
• A reckless violation of this duty is a civil violation of up to $100 per record; a knowing and willful violation is up to $200 per record. Only the Attorney General may bring an action.

R.I. Gen. Laws secs. 11-49.3-4, 11-49.3-5 · Read the law's page

• Notify affected Rhode Island residents of a breach posing a significant risk of identity theft within 45 days of confirming the breach, or within 30 days if you are a state or municipal agency.
• Notify the Attorney General and consumer reporting agencies once more than 500 Rhode Island residents are affected, without delaying notice to residents.