Law / United States / 
Rhode Island
Rhode Island Health Information Exchange Act of 2008 as amended in 2021: opt out and provider participant notice
R.I. Gen. Laws sec. 5-37.7-7(a) to (c)
In force since .
A data subject rights rule binding public and private bodies.
- Obligation class
- Consent, Data subject rights, Disclosure
- Audit expectation
- none
As of .
What it requires
- If you are a provider participant that shares data with the health information exchange, notify your patients that data is being shared with the exchange to support the provision of care and inform them about the ability to opt out, stating that the patient's provider is a provider participant, that the patient may opt out of disclosure from the exchange except as section 5-37.7-7(b) provides, that the choice may be changed at any time, and the method for opting out (section 5-37.7-7(c)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Section 5-37.7-13(b): anyone who intentionally and knowingly violates the chapter shall, upon conviction, be fined not more than $10,000 per patient, per violation, or imprisoned for not more than one year, or both.
Who enforces it
Enforcement body
Patients, who may sue anyone who violates the chapter for actual and exemplary damages (section 5-37.7-13(a)).
Settledness
- As of
What this law does
Section 5-37.7-7(a) of the Rhode Island General Laws lets a patient or the patient's authorized representative opt out of having the patient's confidential healthcare information disclosed from the health information exchange, except in the situations subsection (b) lists.
Section 5-37.7-7(c) of the Rhode Island General Laws requires provider participants who share data with the health information exchange to notify their patients that data is being shared to support the provision of care and to inform their patients about the ability to opt out.
Section 5-37.7-3(18) of the Rhode Island General Laws defines a provider participant as a pharmacy, laboratory, healthcare provider, or health plan that is providing healthcare services or pays for the cost of healthcare services for a patient or is submitting or accessing healthcare information through the health information exchange and has executed an agreement regarding disclosure, access, receipt, retention, or release of confidential healthcare information from the exchange.
Section 5-37.7-10 of the Rhode Island General Laws gives a patient who has confidential healthcare information in the health information exchange the rights to obtain a copy of the information and of the disclosure report, to be notified of a breach of the exchange's security system as chapter 49.3 of title 11 requires, to change the opt out status, to request amendment through the provider participant, and to request disclosure to an authorized representative or to healthcare providers who are not provider participants.
Section 5-37.7-13(a) of the Rhode Island General Laws provides that anyone who violates the chapter may be held liable for actual and exemplary damages. Section 5-37.7-13(b) of the Rhode Island General Laws provides that anyone who intentionally and knowingly violates the chapter shall, upon conviction, be fined not more than $10,000 per patient, per violation, or imprisoned for not more than one year, or both.
Section 5-37.7-7 of the Rhode Island General Laws was amended by Public Law 2021, chapters 362 and 364, effective . Section 5-37.7-7 of the Rhode Island General Laws as enacted in 2008 allowed a patient participant's confidential health care information to be accessed, released or transferred from the health information exchange only in accordance with an authorization form signed by the patient participant or the patient's authorized representative.
When LexLint raises it
When your app profile says your app handles health records.