Rhode Island

Public Law 2026, chapter 376 enacted Senate Bill 2195, Substitute A as amended, on June 22, 2026. The act takes effect on January 1, 2027.

It is unlawful for an operator to operate or provide an "AI companion" (a system using artificial intelligence, generative artificial intelligence, or emotional recognition algorithms to simulate a sustained human or human-like relationship with a user) unless the companion contains a protocol for addressing possible suicidal ideation or self-harm and possible physical harm to others expressed by a user, with a notification referring the user to crisis services.

An operator must give a clear and conspicuous notification to a user at the beginning of any AI companion interaction, and at least every three hours during a continuing interaction, that the user is not communicating with a human. Beginning July 1, 2027, an operator must file annual reports with the Attorney General that include the number of safety protocol activations and related metrics. The Attorney General enforces the chapter, and a violation may result in civil penalties of up to $15,000 per day.

Section 11-9-1.3 defines "child pornography" to include a visual depiction that is a digital image, computer image, or computer-generated image of a minor engaging in sexually explicit conduct, or one that has been created, adapted, or modified to display an identifiable minor engaging in such conduct, alongside the ordinary case of an actual minor's image.

This wording replaced the section's original 2001 text: P.L. 2004, ch. 586 enacted it on July 31, 2004, and P.L. 2004, ch. 612 enacted the identical wording again on August 11, 2004. The definition already reaches an AI-generated or AI-altered depiction and carries no separate reference to artificial intelligence.

Production, transport, or reproduction of covered material is punishable by a fine of not more than $5,000 and imprisonment of not more than fifteen years, or both; mere possession is punishable by not more than $5,000 and five years, or both.

Section 11-64-3(a)(1), as amended by two 2025 public laws effective July 2, 2025, reaches a sexually explicit visual image of an identifiable adult "including any image created by a digital device or altered by digitization," language that covers a synthetic or AI-altered intimate image of a real, identifiable person alongside an unaltered photograph or recording.

Liability requires that the image was made or obtained under circumstances a reasonable person would know were meant to stay private (or was made without consent), was disseminated without the depicted person's consent, and was disseminated with knowledge or reckless disregard of likely harm, or with intent to harass, intimidate, threaten, or coerce.

A first violation is a misdemeanor (up to one year and $1,000); a second or subsequent violation is a felony (up to three years and $3,000); threatening to disclose such an image for a benefit, or demanding payment to remove one from public view, is a separate felony (up to five years and $5,000). Newsworthy, law-enforcement, legal-proceeding, and interactive-computer-service exemptions apply.

This act bars any individual, corporation, or entity from offering therapy or psychotherapy services in Rhode Island, including through internet-based AI, unless the services are conducted by a state-licensed professional or provider.

A licensed provider may use AI only for administrative or supplementary support (scheduling, billing, records, drafting logistics communications, tracking client progress subject to professional review), and never to make independent therapeutic decisions, conduct therapeutic communication directly with a client without an established provider relationship, or determine treatment plans.

Where a client's session is recorded or transcribed and an AI system simulating emotional attachment or bonding assists with supplementary support or therapeutic communication, the patient or their representative must be informed in writing and consent. The act was enacted on June 22, 2026 as Public Law 2026, chapter 373. Its own text provides that it takes effect upon passage.

Effective July 2, 2025, section 17-30-1 bars a candidate, campaign committee, party committee, or independent-expenditure person or entity from distributing, within ninety days of an election, "synthetic media" that realistically but falsely depicts a candidate's appearance, action, or speech in a way that creates a fundamentally different impression than the real, unaltered version, where the distributor knows or should know it is deceptive.

The prohibition does not apply if the media carries a disclosure that it was manipulated or generated by artificial intelligence, sized and timed as the statute specifies for visual and audio media. A depicted candidate may seek injunctive relief and sue for general or special damages plus attorney's fees, proven by clear and convincing evidence. Broadcasters, news publications that label the media as inaccurate, satire and parody, and interactive computer services are exempted.

This act requires any healthcare provider or healthcare facility that employs AI to document an in-person or telehealth visit to notify patients that AI was used for that purpose, and to review the AI-generated documentation for accuracy after the visit. "Healthcare facility" carries the meaning given at section 23-17-2, which reaches a facility whether public or private, so the duty binds a government-run facility as well as a private one.

The act was enacted on June 22, 2026 as Public Law 2026, chapter 199. Its own text provides that it takes effect upon passage.

Any municipal agency, state agency, or person that stores, owns, collects, processes, maintains, acquires, uses, or licenses data including personal information must notify affected Rhode Island residents of a breach that poses a significant risk of identity theft, within 30 days of confirmation for a state or municipal agency and within 45 days for any other person, with Attorney General and consumer-reporting-agency notice required once more than 500 residents are affected.

Reckless violations carry a penalty of up to $100 per record and knowing and willful violations up to $200 per record, brought by the Attorney General; no private right of action was found in the text read. Sections 11-49.3-4 and 11-49.3-5 both originate in P.L. 2015, ch. 138 and ch. 148; sec. 11-49.3-4's notice duty was last amended by P.L. 2023, ch. 375, sec. 1, effective June 27, 2023, while sec. 11-49.3-5's penalty provisions carry no amendment since 2015. The provisions this entry describes came into force on different days.

A domestic insurance company that learns that a cybersecurity event has or may have occurred must conduct, or have an outside vendor or service provider conduct, a prompt investigation. The insurer must maintain records concerning all cybersecurity events for at least five years from the date of the event and must produce those records upon demand of the commissioner.

Each insurer domiciled in the state must also submit an annual written statement of compliance by April 15 and must maintain for examination by the department the records, schedules and data supporting it for five years. The section was enacted with an effective date of January 1, 2025.

A foreign insurance company that learns that a cybersecurity event has or may have occurred must conduct, or have an outside vendor or service provider conduct, a prompt investigation. The insurer must maintain records concerning all cybersecurity events for at least five years from the date of the event and must produce those records upon demand of the commissioner. The section was enacted with an effective date of January 1, 2025.

Section 27-1-47(a) of the Rhode Island General Laws requires each domestic insurer to notify the commissioner as promptly as possible, and no later than three business days from a determination that a cybersecurity event has occurred, when a cybersecurity event impacting the insurer must be reported to a government body, self-regulatory agency or other supervisory body under state or federal law, or has a reasonable likelihood of materially harming any consumer residing in this state or any material part of the insurer's normal operations.

Section 27-1-47(b) of the Rhode Island General Laws requires the insurer to provide the information in electronic form as the commissioner directs and gives it a continuing obligation to update and supplement initial and subsequent notifications.

Section 27-1-47(b) of the Rhode Island General Laws requires the insurer to provide as much as possible of a listed set of information, including the date of the event, how the information was exposed, how the event was discovered, the number of total consumers in this state affected, and a copy of the insurer privacy policy.

Section 27-1-47(c) of the Rhode Island General Laws requires an insurer to comply with chapter 49.3 of title 11, as applicable, and to provide the commissioner a copy of the notice sent to consumers under that chapter when the insurer is required to notify the commissioner.

Section 27-1-47(d) of the Rhode Island General Laws requires an insurer to treat a cybersecurity event involving its nonpublic information in a system maintained by a third-party service provider as it would under subsection (a), with its deadlines beginning on the day after the provider notifies it or it otherwise has actual knowledge, whichever is sooner.

Section 27-1-47(e) of the Rhode Island General Laws requires an assuming insurer to notify its affected ceding insurers and the commissioner of its state of domicile within seventy-two hours of making the determination that a cybersecurity event has occurred.

Section 27-1-47(f) of the Rhode Island General Laws requires an insurer to notify the producers of record of all affected consumers who accessed the insurer's services through an independent insurance producer as soon as practicable as the commissioner directs, and excuses the insurer where it lacks current producer of record information for an individual consumer.

Section 27-1-47 of the Rhode Island General Laws was enacted by Public Law 2024, chapter 354, section 2, and Public Law 2024, chapter 355, section 2, each effective January 1, 2025. Section 27-1-47 of the Rhode Island General Laws was amended by Public Law 2025, chapter 427, article 1, section 2, effective December 31, 2025.

Public Law 2025, chapter 427 (H 6385 Substitute A), enacted July 2, 2025, amended sections 27-1-46 and 27-1-47 of the General Laws, the first headed Information security program.

Section 27-2-30 of the Rhode Island General Laws is in chapter 2 of title 27, Foreign Insurance Companies.

Section 27-2-30(a) of the Rhode Island General Laws requires each insurer to notify the commissioner as promptly as possible, and no later than three business days from a determination that a cybersecurity event has occurred, when the insurer reasonably believes that the nonpublic information involved affects 250 or more consumers residing in this state and the event must be reported to a government body, self-regulatory agency or other supervisory body under state or federal law, or has a reasonable likelihood of materially harming any consumer residing in this state or any material part of the insurer's normal operations.

Section 27-2-30(b) of the Rhode Island General Laws requires the insurer to provide the information in electronic form as the commissioner directs and gives it a continuing obligation to update and supplement initial and subsequent notifications.

Section 27-2-30(b) of the Rhode Island General Laws requires the insurer to provide a listed set of information, including the date of the event, how the information was exposed, how the event was discovered, the number of total consumers in this state affected, and a copy of the insurer privacy policy.

Section 27-2-30(c) of the Rhode Island General Laws requires an insurer to comply with chapter 49.3 of title 11, as applicable, and to provide the commissioner a copy of the notice sent to consumers under that chapter when the insurer is required to notify the commissioner.

Section 27-2-30(d) of the Rhode Island General Laws requires an insurer to treat a cybersecurity event involving its nonpublic information in a system maintained by a third-party service provider as it would under subsection (a), with its deadlines beginning on the day after the provider notifies it or it otherwise has actual knowledge, whichever is sooner.

Section 27-2-30(e) of the Rhode Island General Laws requires an assuming insurer to notify its affected ceding insurers and the commissioner of its state of domicile within seventy-two hours of making the determination that a cybersecurity event has occurred.

Section 27-2-30(f) of the Rhode Island General Laws requires an insurer to notify the producers of record of all affected consumers who accessed the insurer's services through an independent insurance producer as soon as practicable as the commissioner directs, and excuses the insurer where it lacks current producer of record information for an individual consumer.

Section 27-2-30 of the Rhode Island General Laws was enacted by Public Law 2024, chapter 354, section 3, and Public Law 2024, chapter 355, section 3, each effective January 1, 2025.

RIDTPPA applies only to for-profit entities conducting business in Rhode Island, or targeting products or services to Rhode Island residents, that in the preceding calendar year controlled or processed personal data of at least 35,000 customers (excluding payment-only data), or 10,000 customers while deriving more than 20 percent of gross revenue from personal-data sales.

Two companion 2024 bills, H 7787 and S 2500, produced two public laws for the same chapter (P.L. 2024, ch. 430 and ch. 453), both effective January 1, 2026.

A controller must conduct and document a data protection assessment for each processing activity that presents a heightened risk of harm to a customer, which includes targeted advertising, the sale of personal data, some profiling and the processing of sensitive data. The attorney general may require a controller to disclose any data protection assessment that is relevant to an investigation, and the controller must make it available.

Data protection assessments are confidential and exempt from disclosure under the access to public records law. The assessment requirements apply to processing activities created or generated after January 1, 2026, and are not retroactive. The section applies to for-profit entities that conduct business in the state or produce products or services targeted to residents of the state and that meet one of two thresholds on the number of customers whose personal data they control or process.

Section 7.2(A) of 230-RICR-20-60-7 provides that the Part governs the treatment of nonpublic personal health information and nonpublic personal financial information about individuals by all insurance licensees of the Rhode Island Department of Business Regulation, requires a licensee to provide notice about its privacy policies and practices, and provides methods for individuals to prevent a licensee from disclosing that information.

Section 7.4(A)(17) of 230-RICR-20-60-7 defines a licensee as all licensed insurers, producers and other persons licensed or required to be licensed, or authorized or required to be authorized, or registered or required to be registered, pursuant to Title 27 of the Rhode Island General Laws.

Section 7.2(B) of 230-RICR-20-60-7 applies the Part to nonpublic personal financial information about individuals who obtain or are claimants or beneficiaries of products or services primarily for personal, family or household purposes from licensees, and to all nonpublic personal health information.

Section 7.5(A) of 230-RICR-20-60-7 requires a licensee to provide a clear and conspicuous notice that accurately reflects its privacy policies and practices to a customer not later than when the licensee establishes a customer relationship, and to a consumer before the licensee discloses any nonpublic personal financial information about the consumer to a nonaffiliated third party other than as sections 7.16 and 7.17 authorize.

Section 7.6(A) of 230-RICR-20-60-7 requires a licensee to provide customers a clear and conspicuous notice that accurately reflects its privacy policies and practices not less than annually during the continuation of the customer relationship.

Section 7.7(A) of 230-RICR-20-60-7 requires each initial, annual and revised privacy notice to include the categories of nonpublic personal financial information the licensee collects and discloses, the categories of affiliates and nonaffiliated third parties to whom it discloses, an explanation of the consumer's right to opt out and how to exercise it, and the licensee's policies and practices for protecting the confidentiality and security of nonpublic personal financial information.

Section 7.12(A)(1) of 230-RICR-20-60-7 bars a licensee from disclosing, directly or through an affiliate, any nonpublic personal financial information about a consumer to a nonaffiliated third party unless it has provided the initial notice and the opt out notice, has given the consumer a reasonable opportunity to opt out before the disclosure, and the consumer does not opt out.

Section 7.14(A) of 230-RICR-20-60-7 bars a licensee from disclosing, other than to a consumer reporting agency, a policy number or similar access number or access code for a consumer's policy or transaction account to a nonaffiliated third party for use in telemarketing, direct mail marketing or other marketing through electronic mail to the consumer.

Section 7.18(A) of 230-RICR-20-60-7 bars a licensee from disclosing nonpublic personal health information about a consumer or customer unless an authorization is obtained from the consumer or customer whose information is sought to be disclosed. Section 7.19 of 230-RICR-20-60-7 requires a valid authorization to be in written or electronic form and to specify a length of time for which it remains valid, which in no event may be more than twenty-four months.

Section 7.24 of 230-RICR-20-60-7 bars a licensee from unfairly discriminating against a consumer or customer because the consumer or customer has opted out of the disclosure of nonpublic personal financial information, or has not granted authorization for the disclosure of nonpublic personal health information.

Section 7.25 of 230-RICR-20-60-7 authorizes the insurance regulatory authorities of the state to investigate any alleged violation of the Part and to impose fines and other sanctions as lawfully determined to be appropriate in accordance with the applicable laws of the state. The Rhode Island Department of State register lists 230-RICR-20-60-7 as an active rule, refiled effective January 4, 2022 with no change to the text of the rule.

The register entry for the predecessor, Regulation 99, Privacy of Consumer Financial Information, states that its purpose is to govern the treatment of nonpublic personal financial information about individuals by all insurance licensees of the Rhode Island Department of Business Regulation. The register lists an amendment to the rule effective May 14, 2018.

The Rhode Island Department of State register lists the predecessor, Regulation 99, Privacy of Consumer Financial Information, as effective from December 19, 2001 to May 14, 2018.

RIDTPPA gives a Rhode Island customer the right to confirm and access their personal data, correct inaccuracies, delete data, obtain a portable copy, and opt out of targeted advertising, the sale of personal data, and significant-effect profiling. A controller must respond without undue delay and not later than 45 days after receipt, with one 45-day extension available, and must decide an appeal within 60 days, after which the customer may complain to the Attorney General.

Section 5-37.7-7(a) of the Rhode Island General Laws lets a patient or the patient's authorized representative opt out of having the patient's confidential healthcare information disclosed from the health information exchange, except in the situations subsection (b) lists.

Section 5-37.7-7(c) of the Rhode Island General Laws requires provider participants who share data with the health information exchange to notify their patients that data is being shared to support the provision of care and to inform their patients about the ability to opt out.

Section 5-37.7-3(18) of the Rhode Island General Laws defines a provider participant as a pharmacy, laboratory, healthcare provider, or health plan that is providing healthcare services or pays for the cost of healthcare services for a patient or is submitting or accessing healthcare information through the health information exchange and has executed an agreement regarding disclosure, access, receipt, retention, or release of confidential healthcare information from the exchange.

Section 5-37.7-10 of the Rhode Island General Laws gives a patient who has confidential healthcare information in the health information exchange the rights to obtain a copy of the information and of the disclosure report, to be notified of a breach of the exchange's security system as chapter 49.3 of title 11 requires, to change the opt out status, to request amendment through the provider participant, and to request disclosure to an authorized representative or to healthcare providers who are not provider participants.

Section 5-37.7-13(a) of the Rhode Island General Laws provides that anyone who violates the chapter may be held liable for actual and exemplary damages. Section 5-37.7-13(b) of the Rhode Island General Laws provides that anyone who intentionally and knowingly violates the chapter shall, upon conviction, be fined not more than $10,000 per patient, per violation, or imprisoned for not more than one year, or both.

Section 5-37.7-7 of the Rhode Island General Laws was amended by Public Law 2021, chapters 362 and 364, effective July 12, 2021. Section 5-37.7-7 of the Rhode Island General Laws as enacted in 2008 allowed a patient participant's confidential health care information to be accessed, released or transferred from the health information exchange only in accordance with an authorization form signed by the patient participant or the patient's authorized representative.

Section 5-37.7-7(d) of the Rhode Island General Laws provides that, except as specifically provided by state or federal law or the chapter, a patient's confidential healthcare information shall not be accessed by, given, sold, transferred, or in any way relayed from the health information exchange to any other person or entity.

Section 5-37.7-7 of the Rhode Island General Laws as enacted in 2008 provided in subsection (d) that, except as specifically provided by law or the chapter, or use for clinical care, a patient participant's confidential health care information shall not be accessed by, given, sold, transferred, or in any way relayed from the health information exchange to any other person or entity not specified in the patient participant authorization form without first obtaining additional authorization.

Section 5-37.7-7 of the Rhode Island General Laws was amended by Public Law 2021, chapters 362 and 364, effective July 12, 2021. Section 5-37.7-4(a) of the Rhode Island General Laws provides that confidential healthcare information may only be accessed, released, or transferred from the statewide health information exchange in accordance with the chapter.

Section 5-37.7-4(g) of the Rhode Island General Laws imposes on the health information exchange and the regional health information organization the obligation to maintain, and abide by the terms of, Health Insurance Portability and Accountability Act (HIPAA)-compliant business associate agreements.

Section 5-37.7-8 of the Rhode Island General Laws requires the health information exchange to authenticate the recipient of any confidential healthcare information it discloses, limit authorized access to personally identifiable confidential healthcare information to persons having a need to know, identify individuals responsible for security procedures, provide each employee or agent a statement on confidentiality and penalties, and take no disciplinary or punitive action against an employee or agent for bringing evidence of a violation to the attention of any person.

Section 5-37.7-13(a) of the Rhode Island General Laws provides that anyone who violates the chapter may be held liable for actual and exemplary damages. Section 5-37.7-13(b) of the Rhode Island General Laws provides that anyone who intentionally and knowingly violates the chapter shall, upon conviction, be fined not more than $10,000 per patient, per violation, or imprisoned for not more than one year, or both.

Public Law 2008, chapter 171 (S 2679 Substitute A as amended) was enacted on July 2, 2008. Section 3 of the 2008 act on the Rhode Island Health Information Exchange provides that the act takes effect on March 1, 2009.

Section 5-37.3-12(b) of the Rhode Island General Laws requires a health insurer, notwithstanding any other law and to the extent federal law permits, to permit an insured individual or authorized representative to submit a confidential communications request form, to accommodate requests in the form and format requested if readily producible, and to permit communications containing confidential healthcare information to be sent to a specific mail or email address or telephone number the insured individual or authorized representative designates.

Section 5-37.3-12(b)(4) of the Rhode Island General Laws requires a health insurer to implement a confidential communications request within ten calendar days of receiving an electronic transmission or telephonic request, or within ten calendar days of receipt by first-class mail. Section 5-37.3-12(c) of the Rhode Island General Laws bars a health insurer from conditioning coverage on the waiver of the rights the section provides.

Section 5-37.3-12(d) of the Rhode Island General Laws requires all health insurers to create a confidential communications request form that is easily readable and prominently displayed on the health insurer's website. Section 5-37.3-12(a)(3) of the Rhode Island General Laws gives health insurer the same meaning as managed-care entity as defined in section 5-37.3-3.

Section 5-37.3-3(7) of the Rhode Island General Laws provides that a managed-care entity includes a licensed insurance company, hospital, or medical service plan, health maintenance organization, an employer or employee organization, or a managed-care contractor that operates a managed-care plan. Section 5-37.3-12 of the Rhode Island General Laws was enacted by Public Law 2021, chapter 212, section 1, and Public Law 2021, chapter 213, section 1, each effective January 1, 2022.

Section 5-37.3-9(a) of the Rhode Island General Laws provides that anyone who violates the chapter may be held liable for actual and exemplary damages. Section 5-37.3-9(b) of the Rhode Island General Laws provides that anyone who intentionally and knowingly violates the chapter shall, upon conviction, be fined not more than $1,000, or imprisoned for not more than six months, or both.

Section 5-37.3-5(a) of the Rhode Island General Laws requires a third party, on an action or decision that adversely affects a patient and is based in whole or in part on the patient's confidential healthcare information, and on the patient's written request, to transfer copies of all of that patient's confidential healthcare information in its possession to a physician designated in the request, for which it may require payment of its actual cost of retrieval, duplication and forwarding.

Section 5-37.3-5(c) of the Rhode Island General Laws lets a patient who has reviewed the information request the third party to amend or expunge any part the patient believes is in error or to add recent relevant information, requires the third party to notify the healthcare provider who forwarded the information and, where that provider concurs, return the information to the provider for modification, and provides that the patient's statement of reasonable length on correctness or relevance shall at all times accompany the information in contention.

Section 5-37.3-5(d) of the Rhode Island General Laws gives a person the right, when there is an unreasonable refusal to change the records, to apply to the district court to amend or expunge any part of the person's confidential healthcare information in a third party's possession that the person believes to be erroneous.

Section 5-37.3-3(18) of the Rhode Island General Laws defines a third party as a person other than the patient to whom the confidential healthcare information relates and other than a healthcare provider. Section 5-37.3-9(a) of the Rhode Island General Laws provides that anyone who violates the chapter may be held liable for actual and exemplary damages.

Section 5-37.3-9(b) of the Rhode Island General Laws provides that anyone who intentionally and knowingly violates the chapter shall, upon conviction, be fined not more than $1,000, or imprisoned for not more than six months, or both. Section 5-37.3-5 of the Rhode Island General Laws was enacted by Public Law 1978, chapter 297, section 1, and amended by Public Law 1979, chapter 221, section 1. No day on which the provisions this entry describes came into force has been located.

A violation of RIDTPPA is a deceptive trade practice, and intentional disclosure of personal data to a shell company or otherwise in violation of the chapter carries a fine of $100 to $500 per disclosure. The Attorney General has sole enforcement authority, and unlike New Hampshire's and Kentucky's near-identical statutes, no mandatory or discretionary cure period appears in the enforcement section as read. The chapter creates no private right of action.

Section 5-37.3-4(a)(1) of the Rhode Island General Laws provides that, except as subsection (b) or other law provides, a patient's confidential healthcare information shall not be released or transferred without the written consent of the patient or the patient's authorized representative on a consent form meeting subsection (d).

Section 5-37.3-4(a)(1) of the Rhode Island General Laws prohibits managed care entities and managed care contractors writing policies in the state from providing enrollee information that is personal in nature, could reasonably lead to identification of an individual and is not essential for compiling statistical data to any international, national, regional or local medical-information database.

Section 5-37.3-4(b) of the Rhode Island General Laws lists situations in which no consent is required, the first being disclosure to a physician, dentist or other medical personnel who believes in good faith that the information is necessary for diagnosis or treatment of that individual in a medical or dental emergency.

Section 5-37.3-4(c) of the Rhode Island General Laws requires third parties receiving and retaining a patient's confidential healthcare information to limit access to persons with a need to know, identify the individuals responsible for security procedures, give each employee or agent a written statement on confidentiality and penalties, and take no disciplinary action against an employee or agent solely for bringing evidence of a violation to the attention of any person.

Section 5-37.3-4(d) of the Rhode Island General Laws requires a consent form to contain, or in an insurance application or claim to be accompanied by a notice containing, a statement of the need for and proposed uses of the information, a statement of the extent of the information to be released, and a statement that the consent may be withdrawn at any future time.

Section 5-37.3-4(e) of the Rhode Island General Laws provides that, except as specifically provided by law, an individual's confidential healthcare information shall not be given, sold, transferred or in any way relayed to any person not specified in the consent form or notice without the individual's additional written consent on a form stating the need for the proposed new use or transfer.

Section 5-37.3-3(3)(ii) of the Rhode Island General Laws defines confidential healthcare information as all information relating to a patient's healthcare history, diagnosis, condition, treatment, or evaluation obtained from a healthcare provider who has treated the patient.

Section 5-37.3-3(4) of the Rhode Island General Laws defines a healthcare provider as any person licensed by this state to provide or lawfully providing healthcare services, including a physician, hospital, intermediate-care facility or other healthcare facility, dentist, nurse, optometrist, podiatrist, physical therapist, psychiatric social worker, pharmacist, or psychologist, and any officer, employee, or agent of that provider acting in the course and scope of employment or agency related to or supportive of health services.

Section 5-37.3-3(18) of the Rhode Island General Laws defines a third party as a person other than the patient to whom the confidential healthcare information relates and other than a healthcare provider. Section 5-37.3-4(a)(2) of the Rhode Island General Laws provides that a person who violates section 5-37.3-4 may be liable for actual and punitive damages.

Section 5-37.3-4(a)(4) of the Rhode Island General Laws provides that a person who knowingly and intentionally violates section 5-37.3-4 shall, upon conviction, be fined not more than $5,000 for each violation, or imprisoned not more than six months for each violation, or both.

Section 5-37.3-9(b) of the Rhode Island General Laws provides that anyone who intentionally and knowingly violates the chapter shall, upon conviction, be fined not more than $1,000, or imprisoned for not more than six months, or both. Section 5-37.3-4 of the Rhode Island General Laws was enacted by Public Law 1978, chapter 297, section 1. Section 5-37.3-3 of the Rhode Island General Laws was amended by Public Law 2024, chapters 352 and 353, effective June 26, 2024.

Section 5-37.3-4 of the Rhode Island General Laws was last amended by Public Law 2020, chapter 79, article 2, section 1.

Section 28-6.7-1(a) of the Rhode Island General Laws bars an employer, employment agency or licensing agency from directly or indirectly requesting, requiring or administering a genetic test to an employee, licensee or applicant for employment or licensure.

Section 28-6.7-1(a)(2) to (5) of the Rhode Island General Laws bar those parties from affecting the terms, conditions or privileges of employment or licensure of a person who obtains a genetic test, from denying employment or a license or taking other adverse action based on a refusal to submit to a genetic test, to submit a family health history or to reveal whether a test was taken or its results, from otherwise using genetic information to adversely affect an individual, and from revealing genetic information about employees, licensees or applicants.

Section 28-6.7-1(b) of the Rhode Island General Laws bars any person from selling to or interpreting for an employer, employment agency or licensing agency a genetic test of a current or prospective employee or licensee. Section 28-6.7-2.1 of the Rhode Island General Laws defines employer to include the state and all political subdivisions of the state, any person in this state employing individuals, and any person acting in the interest of an employer directly or indirectly.

Section 28-6.7-2.1 of the Rhode Island General Laws defines genetic information as information about genes, gene product, or inherited characteristics that may derive from the individual or a family member, including whether the individual or a family member has sought or obtained a genetic test.

Section 28-6.7-3 of the Rhode Island General Laws lets a court in a civil action alleging a violation of the chapter award a prevailing applicant or employee punitive damages in addition to actual damages and reasonable attorneys' fees and costs, and afford injunctive relief against an employer. Section 28-6.7-1 of the Rhode Island General Laws was enacted by Public Law 1992, chapter 171, and amended by Public Law 2002, chapter 49.

Public Law 2002, chapter 49 (H 7149A as amended), enacted June 8, 2002, amended section 28-6.7-1. Section 4 of the 2002 act on genetic testing as a condition of employment provides that the act takes effect upon passage.

Public Law 2026, chapter 223 (H 7639), the Genetic Information Privacy Act, was enacted on June 19, 2026. Chapter 63 of title 6 of the General Laws, added by section 2 of the act, may be cited as the Genetic Information Privacy Act. The Genetic Information Privacy Act took effect upon passage.

Section 6-63-2(5) of the Genetic Information Privacy Act defines a direct-to-consumer genetic testing company as an entity that sells, markets, interprets or otherwise offers consumer-initiated genetic testing products or services directly to consumers, analyzes genetic data obtained from a consumer, or collects, uses, maintains or discloses genetic data from such a product or service or provided directly by a consumer.

Section 6-63-3(a)(1) of the Genetic Information Privacy Act requires a direct-to-consumer genetic testing company to make available to a consumer a plain-language summary of its privacy practices, a prominent and easily accessible privacy notice, and a notice that the consumer's deidentified genetic or phenotypic information may be shared with third parties for research.

Section 6-63-3(a)(2) of the Genetic Information Privacy Act requires a direct-to-consumer genetic testing company to obtain a consumer's express consent for the collection, use and disclosure of genetic data, with separate and express consent for the use of the data collected, for storing the biological sample after the initial testing, for each use beyond the primary purpose, for each transfer to a third party other than a service provider, and for marketing based on the data.

Section 6-63-3(a) and (b) of the Genetic Information Privacy Act require a company to give a consumer effective mechanisms to revoke consent, at least one through the primary medium through which the company communicates with consumers, to honor a revocation as soon as practicable and not later than thirty days after it, and to destroy the consumer's biological sample within thirty days of receipt of a revocation of consent to store it.

Section 6-63-3(c) of the Genetic Information Privacy Act requires a direct-to-consumer genetic testing company to implement and maintain reasonable security procedures and practices, and to develop procedures that let a consumer access the genetic data, delete the account and genetic data, and have the biological sample destroyed.

Section 6-63-3(d) of the Genetic Information Privacy Act bars a person or public entity from discriminating against a consumer because the consumer exercised a right under the chapter, including by denying goods, services or benefits, charging different prices or rates, or treating the exercise of rights as a basis for suspicion of criminal wrongdoing.

Section 6-63-3(e)(1) of the Genetic Information Privacy Act bars a direct-to-consumer genetic testing company from disclosing a consumer's genetic data to an entity responsible for administering or making decisions about health insurance, life insurance, long-term care insurance, disability insurance or employment, or to an entity that advises such an entity, except as subsection (e)(2) provides.

Section 6-63-6(a)(1) of the Genetic Information Privacy Act excludes medical information governed by chapter 37.3 of title 5 and protected health information held by a covered entity or business associate under the federal health privacy rules. Section 6-63-4(a) and (b) of the Genetic Information Privacy Act assess a civil penalty of up to $1,000 plus court costs on a person who negligently violates the chapter and of $1,000 to $10,000 plus court costs on a person who willfully violates it.

Section 6-63-4(c) of the Genetic Information Privacy Act provides that actions for relief under the chapter are prosecuted exclusively in a court of competent jurisdiction by the attorney general. Section 6-63-4(f) of the Genetic Information Privacy Act makes each violation of the chapter a separate and actionable violation.

Section 27-18-52.1(a) of the Rhode Island General Laws bars insurance administrators, health plans and providers, except as chapter 37.3 of title 5 provides, from releasing genetic information without the individual's prior written authorization, which is required for each disclosure and must include to whom the disclosure is being made.

Section 27-19-44.1(a) of the Rhode Island General Laws bars insurance administrators, health plans and providers, except as chapter 37.3 of title 5 provides, from releasing genetic information without the individual's prior written authorization, which is required for each disclosure and must include to whom the disclosure is being made.

Section 27-20-39.1(a) of the Rhode Island General Laws bars insurance administrators, health plans and providers, except as chapter 37.3 of title 5 provides, from releasing genetic information without the individual's prior written authorization, which is required for each disclosure and must include to whom the disclosure is being made.

Section 27-41-53.1(a) of the Rhode Island General Laws bars insurance administrators, health plans and providers, except as chapter 37.3 of title 5 provides, from releasing genetic information without the individual's prior written authorization, which is required for each disclosure and must include to whom the disclosure is being made.

Section 27-18-52(a) of the Rhode Island General Laws bars insurance administrators, health plans and providers, except as chapter 37.3 of title 5 provides, from releasing genetic information without the individual's prior written authorization, which is required for each disclosure and must include to whom the disclosure is being made.

Section 27-19-44(a) of the Rhode Island General Laws bars insurance administrators, health plans and providers, except as chapter 37.3 of title 5 provides, from releasing genetic information without the individual's prior written authorization, which is required for each disclosure and must include to whom the disclosure is being made.

Section 27-20-39(a) of the Rhode Island General Laws bars insurance administrators, health plans and providers, except as chapter 37.3 of title 5 provides, from releasing genetic information without the individual's prior written authorization, which is required for each disclosure and must include to whom the disclosure is being made.

Section 27-41-53(a) of the Rhode Island General Laws bars insurance administrators, health plans and providers, except as chapter 37.3 of title 5 provides, from releasing genetic information without the individual's prior written authorization, which is required for each disclosure and must include to whom the disclosure is being made. Public Law 2001, chapter 38 (S 803B) was enacted on June 27, 2001.

Section 9 of the insurance genetic testing act enacted in 2001 provides that the act takes effect upon passage. Section 27-18-52.1 of the Rhode Island General Laws was enacted by Public Law 2001, chapter 38, section 2. Section 27-19-44.1 of the Rhode Island General Laws was enacted by Public Law 2001, chapter 38, section 4. Section 27-20-39.1 of the Rhode Island General Laws was enacted by Public Law 2001, chapter 38, section 6.

Section 27-41-53.1 of the Rhode Island General Laws was enacted by Public Law 2001, chapter 38, section 8. Section 27-18-46(b) of the Rhode Island General Laws subjects a person, firm, corporation, association or other legal entity that willfully or negligently violates any provision of its chapter to a civil penalty, assessed by the insurance commissioner, of up to $5,000 for each violation.

Section 27-19-38(b) of the Rhode Island General Laws subjects a person, firm, corporation, association or other legal entity that willfully or negligently violates any provision of its chapter to a civil penalty, assessed by the insurance commissioner, of up to $5,000 for each violation.

Section 27-20-33(b) of the Rhode Island General Laws subjects a person, firm, corporation, association or other legal entity that willfully or negligently violates any provision of its chapter to a civil penalty, assessed by the insurance commissioner, of up to $5,000 for each violation.

Section 27-41-47(b) of the Rhode Island General Laws subjects a person, firm, corporation, association or other legal entity that willfully or negligently violates any provision of its chapter to a civil penalty, assessed by the insurance commissioner, of up to $5,000 for each violation.

Section 27-18-52.1(b) of the Rhode Island General Laws bars an individual or group health insurance contract, plan or policy of the kind the subsection describes from using genetic information or a request for it to reject, deny, limit, cancel, refuse to renew, increase the rates of or affect a group or individual health insurance policy, contract or plan, from requesting or requiring genetic information for coverage and benefit decisions, from releasing genetic information without prior written authorization except with identifiers removed, encrypted or encoded, and from requesting or requiring information as to whether an individual has genetic information.

Section 27-19-44.1(b) of the Rhode Island General Laws bars an individual or group health insurance contract, plan or policy of the kind the subsection describes from using genetic information or a request for it to reject, deny, limit, cancel, refuse to renew, increase the rates of or affect a group or individual health insurance policy, contract or plan, from requesting or requiring genetic information for coverage and benefit decisions, from releasing genetic information without prior written authorization except with identifiers removed, encrypted or encoded, and from requesting or requiring information as to whether an individual has genetic information.

Section 27-20-39.1(b) of the Rhode Island General Laws bars an individual or group health insurance contract, plan or policy of the kind the subsection describes from using genetic information or a request for it to reject, deny, limit, cancel, refuse to renew, increase the rates of or affect a group or individual health insurance policy, contract or plan, from requesting or requiring genetic information for coverage and benefit decisions, from releasing genetic information without prior written authorization except with identifiers removed, encrypted or encoded, and from requesting or requiring information as to whether an individual has genetic information.

Section 27-41-53.1(b) of the Rhode Island General Laws bars an individual or group health insurance contract, plan or policy of the kind the subsection describes from using genetic information or a request for it to reject, deny, limit, cancel, refuse to renew, increase the rates of or affect a group or individual health insurance policy, contract or plan, from requesting or requiring genetic information for coverage and benefit decisions, from releasing genetic information without prior written authorization except with identifiers removed, encrypted or encoded, and from requesting or requiring information as to whether an individual has genetic information.

Section 27-18-52.1(c) of the Rhode Island General Laws defines genetic information as information about genes, gene product, or inherited characteristics that may derive from the individual or a family member. Section 27-18-52.1 as enacted in 2001 applied its subsection (b) to health insurance contracts, plans and policies delivered, issued for delivery or renewed in Rhode Island on or after January 1, 2002.

Section 27-19-44.1 as enacted in 2001 applied its subsection (b) to health insurance contracts, plans and policies delivered, issued for delivery or renewed in Rhode Island on or after January 1, 2002. Section 27-20-39.1 as enacted in 2001 applied its subsection (b) to health insurance contracts, plans and policies delivered, issued for delivery or renewed in Rhode Island on or after January 1, 2002.

Section 27-41-53.1 as enacted in 2001 applied its subsection (b) to health insurance contracts, plans and policies delivered, issued for delivery or renewed in Rhode Island on or after January 1, 2002. Public Law 2001, chapter 38 (S 803B) was enacted on June 27, 2001. Section 9 of the insurance genetic testing act enacted in 2001 provides that the act takes effect upon passage.

Section 27-18-46(b) of the Rhode Island General Laws subjects a person, firm, corporation, association or other legal entity that willfully or negligently violates any provision of its chapter to a civil penalty, assessed by the insurance commissioner, of up to $5,000 for each violation.

Section 27-19-38(b) of the Rhode Island General Laws subjects a person, firm, corporation, association or other legal entity that willfully or negligently violates any provision of its chapter to a civil penalty, assessed by the insurance commissioner, of up to $5,000 for each violation.

Section 27-20-33(b) of the Rhode Island General Laws subjects a person, firm, corporation, association or other legal entity that willfully or negligently violates any provision of its chapter to a civil penalty, assessed by the insurance commissioner, of up to $5,000 for each violation.

Section 27-41-47(b) of the Rhode Island General Laws subjects a person, firm, corporation, association or other legal entity that willfully or negligently violates any provision of its chapter to a civil penalty, assessed by the insurance commissioner, of up to $5,000 for each violation.

Section 27-19-44(b) of the Rhode Island General Laws bars a nonprofit health service corporation subject to the provisions of its chapter from using a genetic test, a request for a genetic test, the results of a genetic test or other genetic information to reject, deny, limit, cancel, refuse to renew, increase the rates of or affect a group or individual health insurance policy, contract or plan, from requesting or requiring a genetic test for coverage and benefit decisions, from releasing the results of a genetic test without prior written authorization except with identifiers removed, encrypted or encoded, and from requesting or requiring information as to whether an individual has ever had a genetic test or participated in genetic testing.

Section 27-20-39(b) of the Rhode Island General Laws bars a nonprofit health insurer subject to the provisions of its chapter from using a genetic test, a request for a genetic test or the results of a genetic test to reject, deny, limit, cancel, refuse to renew, increase the rates of or affect a group or individual health insurance policy, contract or plan, from requesting or requiring a genetic test for coverage and benefit decisions, from releasing the results of a genetic test without prior written authorization except with identifiers removed, encrypted or encoded, and from requesting or requiring information as to whether an individual has ever had a genetic test or participated in genetic testing.

Section 27-41-53(b) of the Rhode Island General Laws bars a health maintenance organization subject to the provisions of its chapter from using a genetic test, a request for a genetic test or the results of a genetic test to reject, deny, limit, cancel, refuse to renew, increase the rates of or affect a group or individual health insurance policy, contract or plan, from requesting or requiring a genetic test for coverage and benefit decisions, from releasing the results of a genetic test without prior written authorization except with identifiers removed, encrypted or encoded, and from requesting or requiring information as to whether an individual has ever had a genetic test or participated in genetic testing.

Public Law 1998, chapter 380 (H 7590A as amended), enacted July 20, 1998, added section 27-19-44 to chapter 19 of title 27, section 27-20-39 to chapter 20 and section 27-41-53 to chapter 41. Section 5 of the 1998 insurance genetic testing act provides that the act takes effect upon passage. Section 27-19-44 of the Rhode Island General Laws was amended by Public Law 2001, chapter 38, section 3.

Section 3 of the insurance genetic testing act enacted in 2001 restated section 27-19-44, and the restated subsection (b) opens with the bar on using a genetic test, a request for genetic test, the results of a genetic test or other genetic information. Section 5 of the insurance genetic testing act enacted in 2001 restated section 27-20-39, and the restated subsection (b) opens with the bar on using a genetic test, a request for genetic or the results of a genetic test.

Section 7 of the insurance genetic testing act enacted in 2001 restated section 27-41-53, and the restated subsection (b) opens with the bar on using a genetic test or request for genetic test the results of a genetic test.

Section 27-19-38(b) of the Rhode Island General Laws subjects a person, firm, corporation, association or other legal entity that willfully or negligently violates any provision of its chapter to a civil penalty, assessed by the insurance commissioner, of up to $5,000 for each violation.

Section 27-20-33(b) of the Rhode Island General Laws subjects a person, firm, corporation, association or other legal entity that willfully or negligently violates any provision of its chapter to a civil penalty, assessed by the insurance commissioner, of up to $5,000 for each violation.

Section 27-41-47(b) of the Rhode Island General Laws subjects a person, firm, corporation, association or other legal entity that willfully or negligently violates any provision of its chapter to a civil penalty, assessed by the insurance commissioner, of up to $5,000 for each violation.

Section 27-41-21(b) of the Rhode Island General Laws makes a person who violates chapter 41 of title 27 guilty of a misdemeanor punishable by a fine not to exceed $500 or imprisonment for a period not exceeding one year, or both.

Section 27-18-52(b)(1) and (2) of the Rhode Island General Laws bar an individual or group health insurance contract, plan or policy that provides medical coverage including physician services in a physician's office, and every major medical or comprehensive-type policy, from using a genetic test, a request for genetic tests or the results of a genetic test to reject, deny, limit, cancel, refuse to renew, increase the rates of or affect a policy, and from requesting or requiring a genetic test to decide whether to issue or renew coverage, to set reimbursement or copay levels, or to determine covered benefits and services.

Section 27-18-52(b)(3) and (4) of the Rhode Island General Laws bar the same policies from releasing the results of a genetic test without the individual's prior written authorization, except in a format with identifiers removed, encrypted or encoded, and from requesting or requiring information as to whether an individual has ever had a genetic test or participated in genetic testing.

Public Law 1998, chapter 380 (H 7590A as amended), enacted July 20, 1998, added section 27-18-52 to chapter 18 of title 27. Section 27-18-52 as enacted in 1998 applied to individual and group health insurance contracts, plans and policies delivered, issued for delivery or renewed in Rhode Island on or after January 1, 1999. Section 5 of the 1998 insurance genetic testing act provides that the act takes effect upon passage.

Public Law 2001, chapter 38 (S 803B), enacted June 27, 2001, amended section 27-18-52. Section 1 of the insurance genetic testing act enacted in 2001 restated section 27-18-52, and the restated subsection (b) opens with the bar on using a genetic test, a request for genetic tests or the results of a genetic test.

Section 27-18-46(b) of the Rhode Island General Laws subjects a person, firm, corporation, association or other legal entity that willfully or negligently violates any provision of its chapter to a civil penalty, assessed by the insurance commissioner, of up to $5,000 for each violation.

Section 27-18-20 of the Rhode Island General Laws makes a person, partnership or corporation that willfully violates a provision of chapter 18 of title 27 liable to forfeit to the state up to $100 for each violation, recoverable by civil action.

Section 6-13-17(a) of the Rhode Island General Laws bars a person, unless federal law requires otherwise, from requiring a consumer of goods or services to disclose all or part of a social security number incident to the sale of consumer goods or services.

Section 6-13-17(a) of the Rhode Island General Laws allows insurance companies and institutions licensed by the state or federal government for financial services to require applicants to disclose a social security number, allows a number to be required for providing and billing health care or pharmaceutical-related services, and allows disclosure to be required as a condition of applying for a credit card.

Section 6-13-17(b) of the Rhode Island General Laws makes a person who violates the section guilty of a misdemeanor punishable on conviction by a fine of not more than $500. Section 6-13-17(c) of the Rhode Island General Laws lets a court in a civil action alleging a violation award a prevailing consumer damages, reasonable attorneys' fees and costs, and afford injunctive relief against a person or business that commits or proposes to commit a violation.

Section 6-13-6 of the Rhode Island General Laws makes it the duty of the attorney general to enforce and restrain violations of the sections of chapter 13 of title 6, and gives the superior court jurisdiction to enjoin an act the chapter forbids on the complaint of any person. Public Law 2011, chapter 57 (H 5202), enacted June 8, 2011, amended sections 6-13-15, 6-13-17 and 6-13-19.

Section 6-13-17 of the Rhode Island General Laws was enacted by Public Law 1993, chapter 435, section 1, and its history note lists later amendments through Public Law 2014, chapter 528.

RIDTPPA classifies genetic or biometric data processed to uniquely identify a person, along with racial or ethnic origin, religious belief, health condition, sex life, sexual orientation, citizenship or immigration status, a known child's data, and precise geolocation, as sensitive data.

"Biometric data" is textually identical to New Hampshire's and Kentucky's definitions: it means data from automatic measurement of a biological characteristic, such as a fingerprint, voiceprint, or eye retina or iris, used to identify a specific individual, and excludes a photograph or recording, or data generated from one, only until that data is generated to identify a specific individual.

Section 6-48-8(a)(1) to (4) of the Rhode Island General Laws bar a person or entity, including a state or local agency, from intentionally communicating or otherwise making available to the general public all or part of an individual's social security number, from printing it on any card required to access products or services, from requiring an individual to transmit it over the Internet unless the connection is secure or the number is encrypted, and from requiring its use to access an Internet website unless a password, unique personal identification number or other authentication device is also required.

Section 6-48-8(a)(5) of the Rhode Island General Laws bars a person or entity from printing all or part of an individual's social security number on any materials mailed to the individual, unless state or federal law requires the number to be on the document to be mailed.

Section 6-48-8(a)(5) of the Rhode Island General Laws provides that a social security number permitted to be mailed may not be printed, in whole or in part, on a postcard or other mailer not requiring an envelope, or be visible on the envelope or without the envelope having been opened.

Section 6-48-8(b) and (c) of the Rhode Island General Laws exclude documents recorded or required to be open to the public under chapter 42-46 and allow the collection, use or release of a social security number as required by state or federal law, or its use for internal verification or administrative purposes.

Section 6-48-8(d) of the Rhode Island General Laws makes a person who violates the section responsible for a civil fine of not more than $3,000, and makes a person who knowingly violates it guilty of a misdemeanor punishable by imprisonment for not more than 30 days, a fine of not more than $5,000, or both. Section 6-48-8 of the Rhode Island General Laws is headed as effective January 1, 2008.

Section 6-48-7(a) of the Rhode Island General Laws makes a person who willfully fails to comply with a requirement the chapter imposes with respect to a consumer liable to that consumer for actual damages or damages of not less than $100 and not more than $1,000, or punitive damages as the court allows, plus, in a successful action, costs and reasonable attorneys' fees.

Section 6-48-7(c) of the Rhode Island General Laws makes a person who is negligent in failing to comply with a requirement the chapter imposes with respect to a consumer liable to that consumer for actual damages and, in a successful action, costs and reasonable attorneys' fees. Section 6-48-4(b) of the Rhode Island General Laws defines a consumer as an individual who is also a resident of this state. Public Law 2006, chapter 226 (H 7148 Substitute A as amended) was enacted on June 29, 2006.

Section 6-13-19 of the Rhode Island General Laws bars a person, firm, corporation or other business entity that offers discount cards for purchases made at any business it maintains from requiring a consumer of goods who applies for a discount card to furnish all or part of a social security number as a condition precedent to the application.

Section 6-13-19 of the Rhode Island General Laws bars the offeror from selling or giving to any other person, firm, corporation or business entity information obtained on the application or by use of a discount card, except that the offeror may disclose it to its affiliates, to service providers that perform services for it, or as required by law, and may transfer it in connection with the sale of its business operations.

Section 6-13-6 of the Rhode Island General Laws makes it the duty of the attorney general to enforce and restrain violations of the sections of chapter 13 of title 6, and gives the superior court jurisdiction to enjoin an act the chapter forbids on the complaint of any person.

As enacted by Public Law 2004, chapter 311, section 6-13-19 barred a business entity that offers discount cards from requiring the applicant's social security number as a condition precedent to the application, and barred the sale or gift of any information obtained on the application or by use of a discount card to any other person, firm, corporation or business entity, with no exceptions.

Public Law 2004, chapter 311 (H 7066 as amended), enacted July 3, 2004, added section 6-13-19 to chapter 13 of title 6. Section 2 of the 2004 act on unfair sales practices provides that the act takes effect upon passage. Section 6-13-19 of the Rhode Island General Laws was enacted by Public Law 2004, chapter 311, section 1, and its history note lists later amendments through Public Law 2014, chapter 528.

Section 16-104-1(b) of the Rhode Island General Laws requires any person who provides a cloud computing service to an educational institution operating within the state to process the data of a student enrolled in kindergarten through twelfth grade for the sole purpose of providing the cloud computing service to the educational institution.

Section 16-104-1(b) of the Rhode Island General Laws bars the processing of that student data for any commercial purposes, including advertising purposes that benefit the cloud computing service provider. Section 16-104-1(c) of the Rhode Island General Laws requires each cloud computing service that enters into a contract to provide such services to certify, in writing, that it will comply with the section.

Section 16-104-1(a)(4) of the Rhode Island General Laws defines student data as any information in any media or format created or provided by a student, or by a school board employee about a student in the course of using a cloud computing service, including the student's name, email address, postal address, email message, documents, unique identifiers, and metadata.

Section 16-104-1(a)(2) of the Rhode Island General Laws defines a cloud computing service provider as an entity other than a public elementary or secondary school that operates a cloud computing service. Section 16-104-1(a)(3) of the Rhode Island General Laws defines to process as to use, access, manipulate, scan, modify, transform, disclose, store, transmit, transfer, retain, aggregate, or dispose of student data.

Section 16-104-1 of the Rhode Island General Laws was enacted by Public Law 2014, chapter 188, section 2, and Public Law 2014, chapter 207, section 2. Public Law 2014, chapter 188 (H 7124 Substitute B) was enacted on June 30, 2014. The 2014 act that added the student data and cloud computing chapter takes effect upon passage.

Section 11-52-1(15)(v) defines a person as "without authority" when he or she has no right or permission of the owner to use a computer, or uses a computer in a manner exceeding his or her right or permission, a broad without-permission-or-exceeding-permission standard rather than the Computer Fraud and Abuse Act (CFAA)'s narrower gates-based test.

Section 11-52-3 makes it a felony to intentionally and without authorization access, alter, damage, or destroy a computer, system, network, program, or data for a fraudulent or other illegal purpose. Section 11-52-4.1 separately criminalizes using a computer or network without authority and with intent to disable data or programs, cause a malfunction, alter or erase data, forge bulk-email headers, or similar disruptive acts, regardless of a fraudulent purpose.

Felony violations of the chapter carry a fine of not more than five thousand dollars and imprisonment of not more than five years, or both. The lesser tier under section 11-52-4.1 (property value of five hundred dollars or less) is a misdemeanor punishable by not more than one year and a one-thousand-dollar fine, a different fine amount from the chapter's general misdemeanor tier of five hundred dollars.

Section 11-52-6 gives any person injured by a violation of the chapter a private civil right of action for compensatory damages, punitive damages, court costs, and reasonable attorney's fees, broader than the federal CFAA's civil-suit route, which is conditioned on specific categories of loss. The sections this entry groups came into force on different days.

RIDTPPA's definition of "personal data" at section 6-48.1-2(18) excludes "publicly available information," defined at (24) as information that is lawfully made available through federal, state, or municipal government records or widely distributed media, or that a controller has a reasonable basis to believe a customer has lawfully made available to the general public.

Unlike California's four-prong CCPA exemption, Rhode Island's exemption has no separate prong reaching information a third party (rather than the data subject) disclosed without restricting the audience, so personal data a scraper pulls from a re-hosted directory or an aggregator that is neither a government record nor the data subject's own act falls outside the exemption and inside RIDTPPA's reach for a controller the Act otherwise covers.

RIDTPPA applies only to for-profit entities that conduct business in, or target products or services to, Rhode Island residents and meet its 35,000-customer or 10,000-customer-plus-20-percent-revenue thresholds; its enforcement and further customer-rights detail are researched in this jurisdiction's privacy topic document.

Each domestic insurance company must develop, implement and maintain a comprehensive written information security program, based on its risk assessment, that contains administrative, technical and physical safeguards for the protection of nonpublic information and its information system. The insurer must designate one or more employees, an affiliate, or an outside vendor to act on its behalf as responsible for the information security program.

The insurer must identify reasonably foreseeable internal or external threats that could result in unauthorized access, transmission, disclosure, misuse, alteration, or destruction of nonpublic information, and assess the likelihood and potential damage of those threats.

Based on its risk assessment the insurer must determine which of the listed security measures are appropriate and implement them, which include access controls, encryption of nonpublic information in transit over an external network and on laptops and portable media, secure development practices, regular testing and monitoring of systems, audit trails, and procedures for the secure disposal of nonpublic information.

If the insurer has a board of directors, the board or an appropriate committee must require executive management to develop, implement and maintain the program and to report in writing at least annually on the program's overall status, the insurer's compliance and material matters.

An insurer must exercise due diligence in selecting its third-party service provider and take reasonable steps to request the provider to implement appropriate administrative, technical and physical measures to protect the information systems and nonpublic information accessible to or held by the provider.

Each insurer must establish a written incident response plan designed to promptly respond to, and recover from, any cybersecurity event that compromises the confidentiality, integrity, or availability of nonpublic information in its possession, its information systems, or the continuing functionality of any aspect of its business or operations.

If the insurer learns that a cybersecurity event has or may have occurred, the insurer or an outside vendor or service provider designated to act on its behalf must conduct a prompt investigation. The insurer must maintain records concerning all cybersecurity events for at least five years from the date of the event and produce them on demand of the commissioner.

Each insurer domiciled in Rhode Island must submit to the commissioner a written statement by April 15 each year certifying that it complies with the section, and must keep the supporting records for five years. An insurer domiciled in Rhode Island that has an information security program prepared for and in compliance with the Health Insurance Portability and Accountability Act can rely on that plan to certify its compliance.

Section 27-1-46 was added by Public Law 2024, chapters 354 and 355, effective January 1, 2025, and was amended by Public Law 2025, chapter 427, article 1, section 2, effective December 31, 2025.

Each foreign insurance company must develop, implement and maintain a comprehensive written information security program, based on its risk assessment, that contains administrative, technical and physical safeguards for the protection of nonpublic information and its information system. The insurer must designate one or more employees, an affiliate, or an outside vendor to act on its behalf as responsible for the information security program.

The insurer must identify reasonably foreseeable internal or external threats that could result in unauthorized access, transmission, disclosure, misuse, alteration, or destruction of nonpublic information, and assess the likelihood and potential damage of those threats.

Based on its risk assessment the insurer must determine which of the listed security measures are appropriate and implement them, which include access controls, encryption of nonpublic information in transit over an external network and on laptops and portable media, secure development practices, regular testing and monitoring of systems, audit trails, and procedures for the secure disposal of nonpublic information.

If the insurer has a board of directors, the board or an appropriate committee must require executive management to develop, implement and maintain the program and to report in writing at least annually on the program's overall status, the insurer's compliance and material matters.

An insurer must exercise due diligence in selecting its third-party service provider and take reasonable steps to request the provider to implement appropriate administrative, technical and physical measures to protect the information systems and nonpublic information accessible to or held by the provider.

Each insurer must establish a written incident response plan designed to promptly respond to, and recover from, any cybersecurity event that compromises the confidentiality, integrity, or availability of nonpublic information in its possession, its information systems, or the continuing functionality of any aspect of its business or operations.

If the insurer learns that a cybersecurity event has or may have occurred, the insurer or an outside vendor or service provider designated to act on its behalf must conduct a prompt investigation. The insurer must maintain records concerning all cybersecurity events for at least five years from the date of the event and produce them on demand of the commissioner. Section 27-2-29 was added by Public Law 2024, chapters 354 and 355, effective January 1, 2025.

Each licensee must develop, implement and maintain a comprehensive information security program that is written in one or more readily accessible parts and contains administrative, technical and physical safeguards appropriate to its size and complexity, the nature and scope of its activities and the sensitivity of the customer information it holds. A licensee is any person licensed under the chapter.

The chapter requires a license to make or fund loans, broker loans, provide currency transmission, cash checks, provide debt-management services, perform the duties of a mortgage-loan originator or service a loan as a third-party loan servicer. A licensee must designate a qualified individual responsible for overseeing, implementing and enforcing the information security program, and where it uses a service provider or affiliate for that role it retains responsibility for compliance.

A licensee must perform a written risk assessment that identifies reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information. A licensee must protect by encryption all customer information held or transmitted in transit over external networks and at rest, or use effective alternative compensating controls reviewed and approved by the qualified individual where encryption is infeasible.

A licensee must implement multi-factor authentication for any individual accessing any information system, unless the qualified individual has approved in writing the use of reasonably equivalent or more secure access controls. Absent effective continuous monitoring, a licensee must conduct annual penetration testing of its information systems and vulnerability assessments at least every six months and whenever material changes occur.

A licensee must establish a written incident response plan designed to promptly respond to, and recover from, any security event materially affecting the confidentiality, integrity, or availability of customer information in its control. A licensee must require the qualified individual to report in writing, at least annually, to the board of directors or equivalent governing body, or to a senior officer responsible for the program where there is none.

A licensee must establish a written plan addressing business continuity and disaster recovery. The section does not apply to a regulated institution as defined in section 19-1-1, its subsidiary, or a bank holding company or subsidiary of a bank holding company subject to federal bank holding company laws and regulations.

If a licensee materially violates an applicable provision of the title or a regulation under it, the department may assess a civil penalty of not more than $1,000 for each violation, or imprisonment not exceeding one year, or both. Section 19-14-35 was added by Public Law 2025, chapters 424 and 425, effective July 2, 2025.

A municipal agency, a state agency, or a person who or that stores, collects, processes, maintains, acquires, uses, owns, or licenses personal information about a Rhode Island resident must implement and maintain a risk-based information security program with reasonable security procedures and practices appropriate to the size and scope of the organization, the nature of the information, and the purpose for which it was collected, to protect the personal information from unauthorized access, use, modification, destruction, or disclosure and to preserve its confidentiality, integrity, and availability.

Personal information may not be retained longer than reasonably required to provide the requested services, meet the purpose for which it was collected, or comply with a written retention policy or legal requirement. It must be destroyed securely, including by shredding, pulverization, incineration, or erasure, regardless of the medium.

A municipal agency, state agency, or person that discloses personal information about a Rhode Island resident to a nonaffiliated third party must require by written contract that the third party implement and maintain the same kind of reasonable security procedures and practices. Sec. 11-49.3-5 makes each reckless violation of the chapter a civil violation of up to $100 per record.

Each knowing and willful violation is a civil violation of up to $200 per record, brought solely by the Attorney General; no private right of action was found in the text read. Both sections originate in P.L. 2015, ch. 138 and P.L. 2015, ch. 148. Public Law 2015, chapter 138, enacted June 26, 2015, provides that it takes effect one year following the date of passage. No source stating the resulting day has been located.

A business must take reasonable steps to destroy, or arrange for the destruction of, a customer's personal information within its custody and control that is no longer to be retained by the business, by shredding, erasing, or otherwise destroying or modifying the personal information to make it unreadable or indecipherable through any means.

The destruction must serve to ensure the security and confidentiality of customer personal information, to protect against any reasonably foreseeable threats or hazards to its security or integrity, and to protect against unauthorized access to or use of it that could result in substantial harm or inconvenience to any customer.

A business is a sole proprietorship, partnership, corporation, association, limited liability company, or other group, however organized and whether or not organized to operate at a profit. The term includes any entity that destroys records, including the state, a state agency, or any political subdivision of the state.

A customer is an individual who provides personal information to a business for the purpose of purchasing or leasing a product or obtaining a service from the business, or whose personal information has been provided to another business from that business.

Personal information is information that identifies, relates to, describes, or is capable of being associated with a particular individual, including his or her signature, social security number, physical characteristics or description, passport number, driver's license or state identification card number, insurance policy number, bank account number, credit card number, debit card number, any other financial information and confidential health care information.

A business that does not take the reasonable steps required is in violation of the chapter, and each record unreasonably disposed of constitutes an individual violation. A customer who incurs actual damages due to a violation may bring a civil action in superior court.

Where the attorney general has reason to believe that a violation has occurred and that proceedings would be in the public interest, the attorney general may sue the business in the name of the state, and the business may be liable for the aggrieved customer's actual damages and a civil penalty of $500 for each violation, not to exceed $50,000.

The chapter does not apply to a bank, credit union or financial institution, as defined under the federal Gramm Leach Bliley Law, that is subject to the regulation of a listed federal regulator or the Department of Business Regulation and to the privacy and security provisions of the Gramm Leach Bliley Act.

It also does not apply to a health insurer, non-profit hospital, or medical service corporation, or to a health care facility, that is subject to the privacy and security standards of the Health Insurance Portability and Accountability Act of 1996. It does not apply to a consumer report agency that is subject to, and in compliance with, the Federal Credit Reporting Act.

It does not apply to a business that enters into a contractual agreement with another business to complete the destruction of a customer's personal information and has physical evidence of that contractual agreement. Chapter 247 of the Public Laws of 2009 provides in section 2 that the act takes effect on January 1, 2010.

A licensee must notify the director or the director's designee as promptly as possible, and in no event later than three business days from a determination that a security event has occurred, when the event must be reported to a governmental or supervisory body under state or federal law or has a reasonable likelihood of materially harming a Rhode Island consumer or a material part of the licensee's normal operations. A licensee is any person licensed under the chapter.

A security event is an event resulting in unauthorized access to, or disruption or misuse of, an information system or information stored on such an information system, or customer information held in physical form. The licensee must provide the information in electronic form as the director directs, and has a continuing obligation to update and supplement its initial and subsequent notifications.

The notice must give the licensee's name and contact information, the types of information involved, the date or date range of the event where it can be determined, the total number of Rhode Island consumers affected or potentially affected, a general description of how the information was exposed, and the efforts under way to remediate the situation.

A licensee must comply with the Identity Theft Protection Act of 2015 as applicable and give the director a copy of the notice sent to consumers when it is required to notify the director. The section does not apply to a regulated institution as defined in section 19-1-1, its subsidiary, or a bank holding company or subsidiary of a bank holding company subject to federal bank holding company laws and regulations.

If a licensee materially violates an applicable provision of the title or a regulation under it, the department may assess a civil penalty of not more than $1,000 for each violation, or imprisonment not exceeding one year, or both. Section 19-14-36 was added by Public Law 2025, chapters 424 and 425, effective July 2, 2025.

A municipal agency or state agency that detects a cybersecurity incident must notify the Rhode Island state police within twenty-four hours of detection. A cybersecurity incident is unauthorized access that could jeopardize the confidentiality, integrity, or availability of critical information systems and critical infrastructure systems, such as first responder networks, water and energy.

The notification must include, to the extent known, a general and brief description of the incident, including how it occurred, and its date, estimated date or date range. An agency required to make the notification that fails to do so may be liable for a violation as set forth in section 11-49.3-5. Each reckless violation of the chapter is a civil violation with a penalty of not more than $100 per record, and each knowing and willful violation carries a penalty of not more than $200 per record. Section 11-49.3-7 was added by Public Law 2023, chapter 375, effective June 27, 2023.