Law / United States / 
Rhode Island
Confidentiality of Health Care Communications and Information Act: consent to release of confidential healthcare information
R.I. Gen. Laws secs. 5-37.3-3, 5-37.3-4, 5-37.3-9
In force.
A sensitive categories rule binding public and private bodies.
- Obligation class
- Consent, Disclosure, Security
- Audit expectation
- none
As of .
What it requires
- Do not release or transfer a patient's confidential healthcare information without the written consent of the patient or the patient's authorized representative on a consent form that meets section 5-37.3-4(d), unless section 5-37.3-4(b) or other law permits it (section 5-37.3-4(a)(1)).
- If you are a managed care entity or managed care contractor writing policies in Rhode Island, do not provide enrollee information that is personal in nature, could reasonably lead to identification of an individual and is not essential for compiling statistical data to any international, national, regional or local medical-information database; transfers to the department of health to carry out its statutory duties are not restricted (section 5-37.3-4(a)(1)).
- Put in each consent form, or in a notice that accompanies it in an application or claim for insurance, a statement of the need for and proposed uses of the information, a statement that all information is to be released or of the extent of the information to be released, and a statement that the consent may be withdrawn at any future time and is subject to revocation, which must be transmitted in writing (section 5-37.3-4(d)).
- Do not give, sell, transfer or in any way relay an individual's confidential healthcare information to any person not specified in the consent form or notice without first obtaining the individual's additional written consent on a form stating the need for the proposed new use or transfer (section 5-37.3-4(e)).
- If you are a third party that receives and retains a patient's confidential healthcare information, limit authorized access to persons with a need to know, identify the individuals responsible for maintaining security procedures, give each employee or agent a written statement on the necessity of confidentiality and the penalties under the chapter, and take no disciplinary or punitive action against an employee or agent solely for bringing evidence of a violation to the attention of any person (section 5-37.3-4(c)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Section 5-37.3-4(a)(4): a person who knowingly and intentionally violates section 5-37.3-4 shall, upon conviction, be fined not more than $5,000 for each violation, or imprisoned not more than six months for each violation, or both.
Who enforces it
Enforcement body
Patients, who may sue a person who violates section 5-37.3-4 for actual and punitive damages (section 5-37.3-4(a)(2)).
Settledness
- As of
What this law does
Section 5-37.3-4(a)(1) of the Rhode Island General Laws provides that, except as subsection (b) or other law provides, a patient's confidential healthcare information shall not be released or transferred without the written consent of the patient or the patient's authorized representative on a consent form meeting subsection (d).
Section 5-37.3-4(a)(1) of the Rhode Island General Laws prohibits managed care entities and managed care contractors writing policies in the state from providing enrollee information that is personal in nature, could reasonably lead to identification of an individual and is not essential for compiling statistical data to any international, national, regional or local medical-information database.
Section 5-37.3-4(b) of the Rhode Island General Laws lists situations in which no consent is required, the first being disclosure to a physician, dentist or other medical personnel who believes in good faith that the information is necessary for diagnosis or treatment of that individual in a medical or dental emergency.
Section 5-37.3-4(c) of the Rhode Island General Laws requires third parties receiving and retaining a patient's confidential healthcare information to limit access to persons with a need to know, identify the individuals responsible for security procedures, give each employee or agent a written statement on confidentiality and penalties, and take no disciplinary action against an employee or agent solely for bringing evidence of a violation to the attention of any person.
Section 5-37.3-4(d) of the Rhode Island General Laws requires a consent form to contain, or in an insurance application or claim to be accompanied by a notice containing, a statement of the need for and proposed uses of the information, a statement of the extent of the information to be released, and a statement that the consent may be withdrawn at any future time.
Section 5-37.3-4(e) of the Rhode Island General Laws provides that, except as specifically provided by law, an individual's confidential healthcare information shall not be given, sold, transferred or in any way relayed to any person not specified in the consent form or notice without the individual's additional written consent on a form stating the need for the proposed new use or transfer.
Section 5-37.3-3(3)(ii) of the Rhode Island General Laws defines confidential healthcare information as all information relating to a patient's healthcare history, diagnosis, condition, treatment, or evaluation obtained from a healthcare provider who has treated the patient.
Section 5-37.3-3(4) of the Rhode Island General Laws defines a healthcare provider as any person licensed by this state to provide or lawfully providing healthcare services, including a physician, hospital, intermediate-care facility or other healthcare facility, dentist, nurse, optometrist, podiatrist, physical therapist, psychiatric social worker, pharmacist, or psychologist, and any officer, employee, or agent of that provider acting in the course and scope of employment or agency related to or supportive of health services.
Section 5-37.3-3(18) of the Rhode Island General Laws defines a third party as a person other than the patient to whom the confidential healthcare information relates and other than a healthcare provider. Section 5-37.3-4(a)(2) of the Rhode Island General Laws provides that a person who violates section 5-37.3-4 may be liable for actual and punitive damages.
Section 5-37.3-4(a)(4) of the Rhode Island General Laws provides that a person who knowingly and intentionally violates section 5-37.3-4 shall, upon conviction, be fined not more than $5,000 for each violation, or imprisoned not more than six months for each violation, or both.
Section 5-37.3-9(b) of the Rhode Island General Laws provides that anyone who intentionally and knowingly violates the chapter shall, upon conviction, be fined not more than $1,000, or imprisoned for not more than six months, or both. Section 5-37.3-4 of the Rhode Island General Laws was enacted by Public Law 1978, chapter 297, section 1. Section 5-37.3-3 of the Rhode Island General Laws was amended by Public Law 2024, chapters 352 and 353, effective .
Section 5-37.3-4 of the Rhode Island General Laws was last amended by Public Law 2020, chapter 79, article 2, section 1.
When LexLint raises it
When your app profile says your app handles health records.