Handles health records, in Rhode Island

R.I. Gen. Laws secs. 27-18-52(a), 27-18-52.1(a), 27-19-44(a), 27-19-44.1(a), 27-20-39(a), 27-20-39.1(a), 27-41-53(a), 27-41-53.1(a) · Read the law's page

• As an insurance administrator, health plan or provider, do not release genetic information without the individual's prior written authorization, required for each disclosure and stating to whom the disclosure is made; research settings governed by the Common Rule are excepted (subsection (a) of sections 27-18-52, 27-18-52.1, 27-19-44, 27-19-44.1, 27-20-39, 27-20-39.1, 27-41-53 and 27-41-53.1).

R.I. Gen. Laws sec. 23-17.17-10(a), (b) · Read the law's page

• Remove all personal identifiers from the data you submit to the director under chapter 17.17 of title 23; if you are an insurer, assign to each subscriber record a unique identifier not linked to any personally identifiable information (R.I. Gen. Laws sec. 23-17.17-10(b)).

R.I. Gen. Laws secs. 5-37.7-7(d), 5-37.7-13 · Read the law's page

• Do not access, give, sell, transfer or in any way relay a patient's confidential healthcare information from the health information exchange to any other person or entity except as state or federal law or the chapter specifically provides (section 5-37.7-7(d)).

R.I. Gen. Laws sec. 5-37.7-7(a) to (c) · Read the law's page

• If you are a provider participant that shares data with the health information exchange, notify your patients that data is being shared with the exchange to support the provision of care and inform them about the ability to opt out, stating that the patient's provider is a provider participant, that the patient may opt out of disclosure from the exchange except as section 5-37.7-7(b) provides, that the choice may be changed at any time, and the method for opting out (section 5-37.7-7(c)).

R.I. Gen. Laws sec. 5-37.3-4(b)(3) · Read the law's page

• If you are qualified personnel who receive confidential healthcare information without patient consent for scientific research, management audits, financial audits, program evaluations, actuarial, insurance underwriting or similar studies, do not identify, directly or indirectly, any individual patient in any report of that research, audit or evaluation, and do not otherwise disclose patient identities in any manner (R.I. Gen. Laws sec. 5-37.3-4(b)(3)).

R.I. Gen. Laws sec. 5-37.3-5 · Read the law's page

• After you take an action or make a decision that adversely affects a patient and is based in whole or in part on the patient's confidential healthcare information (for example, denying an insurance application, issuing a policy with other than standard and uniform restrictions, rejecting a claim, or denying or terminating employment for health reasons), transfer copies of all of that patient's confidential healthcare information in your possession to the physician the patient designates in a written request; you may require payment of your actual cost of retrieval, duplication and forwarding (section 5-37.3-5(a)).
• When a patient asks you to amend or expunge any part of the information or to add recent relevant information, notify the healthcare provider who initially forwarded the information and, where that provider concurs, return the information to the provider for modification; do not modify it yourself except on court order (section 5-37.3-5(c)).
• Keep the patient's statement of reasonable length about the correctness or relevance of the information with the part of the information in contention at all times (section 5-37.3-5(c)).

R.I. Gen. Laws secs. 5-37.3-3, 5-37.3-4, 5-37.3-9 · Read the law's page

• Do not release or transfer a patient's confidential healthcare information without the written consent of the patient or the patient's authorized representative on a consent form that meets section 5-37.3-4(d), unless section 5-37.3-4(b) or other law permits it (section 5-37.3-4(a)(1)).
• If you are a managed care entity or managed care contractor writing policies in Rhode Island, do not provide enrollee information that is personal in nature, could reasonably lead to identification of an individual and is not essential for compiling statistical data to any international, national, regional or local medical-information database; transfers to the department of health to carry out its statutory duties are not restricted (section 5-37.3-4(a)(1)).
• Put in each consent form, or in a notice that accompanies it in an application or claim for insurance, a statement of the need for and proposed uses of the information, a statement that all information is to be released or of the extent of the information to be released, and a statement that the consent may be withdrawn at any future time and is subject to revocation, which must be transmitted in writing (section 5-37.3-4(d)).
• Do not give, sell, transfer or in any way relay an individual's confidential healthcare information to any person not specified in the consent form or notice without first obtaining the individual's additional written consent on a form stating the need for the proposed new use or transfer (section 5-37.3-4(e)).
• If you are a third party that receives and retains a patient's confidential healthcare information, limit authorized access to persons with a need to know, identify the individuals responsible for maintaining security procedures, give each employee or agent a written statement on the necessity of confidentiality and the penalties under the chapter, and take no disciplinary or punitive action against an employee or agent solely for bringing evidence of a violation to the attention of any person (section 5-37.3-4(c)).