Law / United States / 
Rhode Island
Right to confidential communication of confidential healthcare information: health insurers
In force since .
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights, Disclosure
- Audit expectation
- none
As of .
What it requires
- As a health insurer, permit an insured individual or authorized representative to submit a confidential communications request form, and accommodate requests in the form and format requested if it is readily producible (section 5-37.3-12(b)(1)).
- Communicate confidential healthcare information to the specific mail or email address or telephone number the insured individual or authorized representative designates (section 5-37.3-12(b)(1)).
- Implement a confidential communications request within ten calendar days of receiving it by electronic transmission, telephone or first-class mail, acknowledge receipt, and advise the insured individual or authorized representative of the status of implementation when contacted (section 5-37.3-12(b)(4)).
- Create a confidential communications request form that is easily readable and prominently displayed on your website, and do not condition coverage on the waiver of these rights (section 5-37.3-12(c) and (d)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Section 5-37.3-9(b): anyone who intentionally and knowingly violates the chapter shall, upon conviction, be fined not more than $1,000, or imprisoned for not more than six months, or both.
Who enforces it
Enforcement body
Insured individuals, who may sue anyone who violates the chapter for actual and exemplary damages (section 5-37.3-9(a)).
Settledness
- As of
What this law does
Section 5-37.3-12(b) of the Rhode Island General Laws requires a health insurer, notwithstanding any other law and to the extent federal law permits, to permit an insured individual or authorized representative to submit a confidential communications request form, to accommodate requests in the form and format requested if readily producible, and to permit communications containing confidential healthcare information to be sent to a specific mail or email address or telephone number the insured individual or authorized representative designates.
Section 5-37.3-12(b)(4) of the Rhode Island General Laws requires a health insurer to implement a confidential communications request within ten calendar days of receiving an electronic transmission or telephonic request, or within ten calendar days of receipt by first-class mail. Section 5-37.3-12(c) of the Rhode Island General Laws bars a health insurer from conditioning coverage on the waiver of the rights the section provides.
Section 5-37.3-12(d) of the Rhode Island General Laws requires all health insurers to create a confidential communications request form that is easily readable and prominently displayed on the health insurer's website. Section 5-37.3-12(a)(3) of the Rhode Island General Laws gives health insurer the same meaning as managed-care entity as defined in section 5-37.3-3.
Section 5-37.3-3(7) of the Rhode Island General Laws provides that a managed-care entity includes a licensed insurance company, hospital, or medical service plan, health maintenance organization, an employer or employee organization, or a managed-care contractor that operates a managed-care plan. Section 5-37.3-12 of the Rhode Island General Laws was enacted by Public Law 2021, chapter 212, section 1, and Public Law 2021, chapter 213, section 1, each effective .
Section 5-37.3-9(a) of the Rhode Island General Laws provides that anyone who violates the chapter may be held liable for actual and exemplary damages. Section 5-37.3-9(b) of the Rhode Island General Laws provides that anyone who intentionally and knowingly violates the chapter shall, upon conviction, be fined not more than $1,000, or imprisoned for not more than six months, or both.
When LexLint raises it
When your app profile says your app is an insurer.