Law / United States / 
Rhode Island
Rhode Island Health Information Exchange Act of 2008: bar on relaying confidential healthcare information from the exchange
R.I. Gen. Laws secs. 5-37.7-7(d), 5-37.7-13
In force since .
A data subject rights rule binding public and private bodies.
- Obligation class
- Prohibition, Consent
- Audit expectation
- none
As of .
What it requires
- Do not access, give, sell, transfer or in any way relay a patient's confidential healthcare information from the health information exchange to any other person or entity except as state or federal law or the chapter specifically provides (section 5-37.7-7(d)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Section 5-37.7-13(b): anyone who intentionally and knowingly violates the chapter shall, upon conviction, be fined not more than $10,000 per patient, per violation, or imprisoned for not more than one year, or both.
Who enforces it
Enforcement body
Patients, who may sue anyone who violates the chapter for actual and exemplary damages (section 5-37.7-13(a)).
Settledness
- As of
What this law does
Section 5-37.7-7(d) of the Rhode Island General Laws provides that, except as specifically provided by state or federal law or the chapter, a patient's confidential healthcare information shall not be accessed by, given, sold, transferred, or in any way relayed from the health information exchange to any other person or entity.
Section 5-37.7-7 of the Rhode Island General Laws as enacted in 2008 provided in subsection (d) that, except as specifically provided by law or the chapter, or use for clinical care, a patient participant's confidential health care information shall not be accessed by, given, sold, transferred, or in any way relayed from the health information exchange to any other person or entity not specified in the patient participant authorization form without first obtaining additional authorization.
Section 5-37.7-7 of the Rhode Island General Laws was amended by Public Law 2021, chapters 362 and 364, effective . Section 5-37.7-4(a) of the Rhode Island General Laws provides that confidential healthcare information may only be accessed, released, or transferred from the statewide health information exchange in accordance with the chapter.
Section 5-37.7-4(g) of the Rhode Island General Laws imposes on the health information exchange and the regional health information organization the obligation to maintain, and abide by the terms of, Health Insurance Portability and Accountability Act (HIPAA)-compliant business associate agreements.
Section 5-37.7-8 of the Rhode Island General Laws requires the health information exchange to authenticate the recipient of any confidential healthcare information it discloses, limit authorized access to personally identifiable confidential healthcare information to persons having a need to know, identify individuals responsible for security procedures, provide each employee or agent a statement on confidentiality and penalties, and take no disciplinary or punitive action against an employee or agent for bringing evidence of a violation to the attention of any person.
Section 5-37.7-13(a) of the Rhode Island General Laws provides that anyone who violates the chapter may be held liable for actual and exemplary damages. Section 5-37.7-13(b) of the Rhode Island General Laws provides that anyone who intentionally and knowingly violates the chapter shall, upon conviction, be fined not more than $10,000 per patient, per violation, or imprisoned for not more than one year, or both.
Public Law 2008, chapter 171 (S 2679 Substitute A as amended) was enacted on . Section 3 of the 2008 act on the Rhode Island Health Information Exchange provides that the act takes effect on .
When LexLint raises it
When your app profile says your app handles health records.