Rhode Island 2025 Regular Session

Rhode Island Senate Bill S0700 Compare Versions

Only one version of the bill is available at this time.

Old	New	Differences
1	1
2	2
3	3
4	4
5	5	2025 -- S 0700
6	6	========
7	7	LC001364
8	8	========
9	9	S T A T E O F R H O D E I S L A N D
10	10	IN GENERAL ASSEMBLY
11	11	JANUARY SESSION, A.D. 2025
12	12	____________
13	13
14	14	A N A C T
15	15	RELATING TO BUSINESSES AND PROFESSIONS -- CONFIDENTIALITY OF HEALTH
16	16	CARE COMMUNICATIONS AND INFORMATION ACT
17	17	Introduced By: Senator Melissa A. Murray
18	18	Date Introduced: March 07, 2025
19	19	Referred To: Senate Health & Human Services
20	20	(BHDDH)
21	21
22	22	It is enacted by the General Assembly as follows:
23	23	SECTION 1. Section 5-37.3-4 of the General Laws in Chapter 5-37.3 entitled 1
24	24	"Confidentiality of Health Care Communications and Information Act" is hereby amended to read 2
25	25	as follows: 3
26	26	5-37.3-4. Limitations on and permitted disclosures. 4
27	27	(a)(1) Except as provided in subsection (b), or as specifically provided by the law, a 5
28	28	patient’s confidential healthcare information shall not be released or transferred without the written 6
29	29	consent of the patient, or his or her authorized representative, on a consent form meeting the 7
30	30	requirements of subsection (d). A copy of any notice used pursuant to subsection (d) and of any 8
31	31	signed consent shall, upon request, be provided to the patient prior to his or her signing a consent 9
32	32	form. Any and all managed care entities and managed care contractors writing policies in the state 10
33	33	shall be prohibited from providing any information related to enrollees that is personal in nature 11
34	34	and could reasonably lead to identification of an individual and is not essential for the compilation 12
35	35	of statistical data related to enrollees, to any international, national, regional, or local medical-13
36	36	information database. This provision shall not restrict or prohibit the transfer of information to the 14
37	37	department of health to carry out its statutory duties and responsibilities. 15
38	38	(2) Any person who violates the provisions of this section may be liable for actual and 16
39	39	punitive damages. 17
40	40	(3) The court may award a reasonable attorney’s fee at its discretion to the prevailing party 18
41	41
42	42
43	43	LC001364 - Page 2 of 10
44	44	in any civil action under this section. 1
45	45	(4) Any person who knowingly and intentionally violates the provisions of this section 2
46	46	shall, upon conviction, be fined not more than five thousand ($5,000) dollars for each violation, or 3
47	47	imprisoned not more than six (6) months for each violation, or both. 4
48	48	(5) Any contract or agreement that purports to waive the provisions of this section shall be 5
49	49	declared null and void as against public policy. 6
50	50	(b) No consent for release or transfer of confidential healthcare information shall be 7
51	51	required in the following situations: 8
52	52	(1) To a physician, dentist, or other medical personnel who believes, in good faith, that the 9
53	53	information is necessary for diagnosis or treatment of that individual in a medical or dental 10
54	54	emergency; 11
55	55	(2) To medical and dental peer-review boards, or the board of medical licensure and 12
56	56	discipline, or board of examiners in dentistry; 13
57	57	(3) To qualified personnel for the purpose of conducting scientific research, management 14
58	58	audits, financial audits, program evaluations, actuarial, insurance underwriting, or similar studies; 15
59	59	provided, that personnel shall not identify, directly or indirectly, any individual patient in any report 16
60	60	of that research, audit, or evaluation, or otherwise disclose patient identities in any manner; 17
61	61	(4)(i) By a healthcare provider to appropriate law enforcement personnel, or to a person if 18
62	62	the healthcare provider believes that person, or his or her family, is in danger from a patient; or to 19
63	63	appropriate law enforcement personnel if the patient has, or is attempting to obtain, narcotic drugs 20
64	64	from the healthcare provider illegally; or to appropriate law enforcement personnel, or appropriate 21
65	65	child-protective agencies, if the patient is a minor child or the parent or guardian of said child and/or 22
66	66	the healthcare provider believes, after providing healthcare services to the patient, that the child is, 23
67	67	or has been, physically, psychologically, or sexually abused and neglected as reportable pursuant 24
68	68	to § 40-11-3; or to appropriate law enforcement personnel or the office of healthy aging if the 25
69	69	patient is an elder person and the healthcare provider believes, after providing healthcare services 26
70	70	to the patient, that the elder person is, or has been, abused, neglected, or exploited as reportable 27
71	71	pursuant to § 42-66-8; to report allegations of abuse, neglect, mistreatment, exploitation, death or 28
72	72	violation of rights to the department of behavioral healthcare, developmental disabilities and 29
73	73	hospitals (BHDDH), or to produce records to BHDDH when BHDDH makes a written demand for 30
74	74	records to a BHDDH-licensed organization, and/or to a facility or program subject to chapter 5 of 31
75	75	title 40.1 ("mental health law"), pursuant to either chapter 5, 24, 24.5, 26 or 27 of title 40.1 for any 32
76	76	of the organization's or client's or patient's records; or to law enforcement personnel in the case of 33
77	77	a gunshot wound reportable under § 11-47-48, or to patient emergency contacts and certified peer 34
78	78
79	79
80	80	LC001364 - Page 3 of 10
81	81	recovery specialists notified in the case of an opioid overdose reportable under § 23-17.26-3; 1
82	82	(ii) A healthcare provider may disclose protected health information in response to a law 2
83	83	enforcement official’s request for such information for the purpose of identifying or locating a 3
84	84	suspect, fugitive, material witness, or missing person, provided that the healthcare provider may 4
85	85	disclose only the following information: 5
86	86	(A) Name and address; 6
87	87	(B) Date and place of birth; 7
88	88	(C) Social security number; 8
89	89	(D) ABO blood type and RH factor; 9
90	90	(E) Type of injury; 10
91	91	(F) Date and time of treatment; 11
92	92	(G) Date and time of death, if applicable; and 12
93	93	(H) A description of distinguishing physical characteristics, including height, weight, 13
94	94	gender, race, hair and eye color, presence or absence of facial hair (beard or moustache), scars, and 14
95	95	tattoos. 15
96	96	(I) Except as permitted by this subsection, the healthcare provider may not disclose for the 16
97	97	purposes of identification or location under this subsection any protected health information related 17
98	98	to the patient’s DNA or DNA analysis, dental records, or typing, samples, or analysis of body fluids 18
99	99	or tissue; 19
100	100	(iii) A healthcare provider may disclose protected health information in response to a law 20
101	101	enforcement official’s request for such information about a patient who is, or is suspected to be, a 21
102	102	victim of a crime, other than disclosures that are subject to subsection (b)(4)(vii), if: 22
103	103	(A) The patient agrees to the disclosure; or 23
104	104	(B) The healthcare provider is unable to obtain the patient’s agreement because of 24
105	105	incapacity or other emergency circumstances provided that: 25
106	106	(1) The law enforcement official represents that the information is needed to determine 26
107	107	whether a violation of law by a person other than the victim has occurred, and such information is 27
108	108	not intended to be used against the victim; 28
109	109	(2) The law enforcement official represents that immediate law enforcement activity that 29
110	110	depends upon the disclosure would be materially and adversely affected by waiting until the patient 30
111	111	is able to agree to the disclosure; and 31
112	112	(3) The disclosure is in the best interests of the patient as determined by the healthcare 32
113	113	provider in the exercise of professional judgment; 33
114	114	(iv) A healthcare provider may disclose protected health information about a patient who 34
115	115
116	116
117	117	LC001364 - Page 4 of 10
118	118	has died to a law enforcement official for the purpose of alerting law enforcement of the death of 1
119	119	the patient if the healthcare provider has a suspicion that such death may have resulted from 2
120	120	criminal conduct; 3
121	121	(v) A healthcare provider may disclose to a law enforcement official protected health 4
122	122	information that the healthcare provider believes in good faith constitutes evidence of criminal 5
123	123	conduct that occurred on the premises of the healthcare provider; 6
124	124	(vi)(A) A healthcare provider providing emergency health care in response to a medical 7
125	125	emergency, other than such emergency on the premises of the covered healthcare provider, may 8
126	126	disclose protected health information to a law enforcement official if such disclosure appears 9
127	127	necessary to alert law enforcement to: 10
128	128	(1) The commission and nature of a crime; 11
129	129	(2) The location of such crime or of the victim(s) of such crime; and 12
130	130	(3) The identity, description, and location of the perpetrator of such crime. 13
131	131	(B) If a healthcare provider believes that the medical emergency described in subsection 14
132	132	(b)(4)(vi)(A) is the result of abuse, neglect, or domestic violence of the individual in need of 15
133	133	emergency health care, subsection (b)(4)(vi)(A) does not apply and any disclosure to a law 16
134	134	enforcement official for law enforcement purposes is subject to subsection (b)(4)(vii); 17
135	135	(vii)(A) Except for reports permitted by subsection (b)(4)(i), a healthcare provider may 18
136	136	disclose protected health information about a patient the healthcare provider reasonably believes to 19
137	137	be a victim of abuse, neglect, or domestic violence to law enforcement or a government authority, 20
138	138	including a social-service or protective-services agency, authorized by law to receive reports of 21
139	139	such abuse, neglect, or domestic violence: 22
140	140	(1) To the extent the disclosure is required by law and the disclosure complies with, and is 23
141	141	limited to, the relevant requirements of such law; 24
142	142	(2) If the patient agrees to the disclosure; or 25
143	143	(3) To the extent the disclosure is expressly authorized by statute or regulation and: 26
144	144	(i) The healthcare provider, in the exercise of professional judgment, believes the 27
145	145	disclosure is necessary to prevent serious harm to the patient or other potential victims; or 28
146	146	(ii) If the patient is unable to agree because of incapacity, a law enforcement or other public 29
147	147	official authorized to receive the report represents that the protected health information for which 30
148	148	disclosure is sought is not intended to be used against the patient and that an immediate enforcement 31
149	149	activity that depends upon the disclosure would be materially and adversely affected by waiting 32
150	150	until the patient is able to agree to the disclosure. 33
151	151	(B) A healthcare provider that makes a disclosure permitted by subsection (b)(4)(vii)(A) 34
152	152
153	153
154	154	LC001364 - Page 5 of 10
155	155	must promptly inform the patient that such a report has been, or will be, made, except if: 1
156	156	(1) The healthcare facility, in the exercise of professional judgment, believes informing the 2
157	157	patient would place the individual at risk of serious harm; or 3
158	158	(2) The healthcare provider would be informing a personal representative, and the 4
159	159	healthcare provider reasonably believes the personal representative is responsible for the abuse, 5
160	160	neglect, or other injury, and that informing such person would not be in the best interests of the 6
161	161	individual as determined by the covered entity in the exercise of professional judgment; 7
162	162	(viii) The disclosures authorized by this subsection shall be limited to the minimum amount 8
163	163	of information necessary to accomplish the intended purpose of the release of information; 9
164	164	(ix) If any staff member of the department of behavioral healthcare, developmental 10
165	165	disabilities and hospitals (BHDDH) who is authorized by its director makes a written demand for 11
166	166	records pursuant to either chapter 5, 24, 24.5, 26 or 27 of title 40.1 for any of the organization's or 12
167	167	client's or patient's records while BHDDH is investigating an alleged incident of abuse, neglect, 13
168	168	mistreatment, exploitation, death, or other violation of rights of an individual who has received or 14
169	169	is receiving services from either a facility or program subject to chapter 5 of title 40.1 ("mental 15
170	170	health law") or an organization licensed by BHDDH, the records identified in such written demand 16
171	171	for records shall be immediately produced to BHDDH; provided, however, that: 17
172	172	(A) The BHDDH written demand for records shall include notice that BHDDH has opened 18
173	173	an investigation with regard to abuse, neglect, mistreatment, exploitation, death, or violation of 19
174	174	rights of a patient or client of the facility, program or organization, and the notice shall include the 20
175	175	patient's or client's name if BHDDH is aware of the name. 21
176	176	(B) If the recipient of the written demand for records fails to comply, BHDDH may file in 22
177	177	the superior court a petition for writ of mandamus or similar petition for the records requested in 23
178	178	the written demand for records. 24
179	179	(C) For purposes of this section, BHDDH is designated as a health oversight agency as the 25
180	180	term is used in 42 CFR S 164.512, and is designated as both a social-service agency and protective 26
181	181	services agency as those terms are used in this section. 27
182	182	(5) Between, or among, qualified personnel and healthcare providers within the healthcare 28
183	183	system for purposes of coordination of healthcare services given to the patient and for purposes of 29
184	184	education and training within the same healthcare facility; 30
185	185	(6) To third-party health insurers, including to utilization review agents as provided by § 31
186	186	23-17.12-9(c)(4), third-party administrators licensed pursuant to chapter 20.7 of title 27, and other 32
187	187	entities that provide operational support to adjudicate health insurance claims or administer health 33
188	188	benefits; 34
189	189
190	190
191	191	LC001364 - Page 6 of 10
192	192	(7) To a malpractice insurance carrier or lawyer if the healthcare provider has reason to 1
193	193	anticipate a medical-liability action; 2
194	194	(8)(i) To the healthcare provider’s own lawyer or medical-liability insurance carrier if the 3
195	195	patient whose information is at issue brings a medical-liability action against a healthcare provider. 4
196	196	(ii) Disclosure by a healthcare provider of a patient’s healthcare information that is relevant 5
197	197	to a civil action brought by the patient against any person or persons other than that healthcare 6
198	198	provider may occur only under the discovery methods provided by the applicable rules of civil 7
199	199	procedure (federal or state). This disclosure shall not be through ex parte contacts and not through 8
200	200	informal ex parte contacts with the provider by persons other than the patient or his or her legal 9
201	201	representative. 10
202	202	Nothing in this section shall limit the right of a patient, or his or her attorney, to consult 11
203	203	with that patient’s own physician and to obtain that patient’s own healthcare information; 12
204	204	(9) To public-health authorities in order to carry out their functions as described in this title 13
205	205	and titles 21 and 23 and rules promulgated under those titles. These functions include, but are not 14
206	206	restricted to, investigations into the causes of disease, the control of public-health hazards, 15
207	207	enforcement of sanitary laws, investigation of reportable diseases, certification and licensure of 16
208	208	health professionals and facilities, review of health care such as that required by the federal 17
209	209	government and other governmental agencies; 18
210	210	(10) To the state medical examiner in the event of a fatality that comes under his or her 19
211	211	jurisdiction; 20
212	212	(11) In relation to information that is directly related to a current claim for workers’ 21
213	213	compensation benefits or to any proceeding before the workers’ compensation commission or 22
214	214	before any court proceeding relating to workers’ compensation; 23
215	215	(12) To the attorneys for a healthcare provider whenever that provider considers that 24
216	216	release of information to be necessary in order to receive adequate legal representation; 25
217	217	(13) By a healthcare provider to appropriate school authorities of disease, health screening, 26
218	218	and/or immunization information required by the school; or when a school-age child transfers from 27
219	219	one school or school district to another school or school district; 28
220	220	(14) To a law enforcement authority to protect the legal interest of an insurance institution, 29
221	221	agent, or insurance-support organization in preventing and prosecuting the perpetration of fraud 30
222	222	upon them; 31
223	223	(15) To a grand jury, or to a court of competent jurisdiction, pursuant to a subpoena or 32
224	224	subpoena duces tecum when that information is required for the investigation or prosecution of 33
225	225	criminal wrongdoing by a healthcare provider relating to his, her or its provisions of healthcare 34
226	226
227	227
228	228	LC001364 - Page 7 of 10
229	229	services and that information is unavailable from any other source; provided, that any information 1
230	230	so obtained, is not admissible in any criminal proceeding against the patient to whom that 2
231	231	information pertains; 3
232	232	(16) To the state board of elections pursuant to a subpoena or subpoena duces tecum when 4
233	233	that information is required to determine the eligibility of a person to vote by mail ballot and/or the 5
234	234	legitimacy of a certification by a physician attesting to a voter’s illness or disability; 6
235	235	(17) To certify, pursuant to chapter 20 of title 17, the nature and permanency of a person’s 7
236	236	illness or disability, the date when that person was last examined and that it would be an undue 8
237	237	hardship for the person to vote at the polls so that the person may obtain a mail ballot; 9
238	238	(18) To the central cancer registry; 10
239	239	(19) To the Medicaid fraud control unit of the attorney general’s office for the investigation 11
240	240	or prosecution of criminal or civil wrongdoing by a healthcare provider relating to his, her, or its 12
241	241	provision of healthcare services to then-Medicaid-eligible recipients or patients, residents, or 13
242	242	former patients or residents of long-term residential-care facilities; provided, that any information 14
243	243	obtained shall not be admissible in any criminal proceeding against the patient to whom that 15
244	244	information pertains; 16
245	245	(20) To the state department of children, youth and families pertaining to the disclosure of 17
246	246	healthcare records of children in the custody of the department; 18
247	247	(21) To the foster parent, or parents, pertaining to the disclosure of healthcare records of 19
248	248	children in the custody of the foster parent, or parents; provided, that the foster parent or parents 20
249	249	receive appropriate training and have ongoing availability of supervisory assistance in the use of 21
250	250	sensitive information that may be the source of distress to these children; 22
251	251	(22) A hospital may release the fact of a patient’s admission and a general description of a 23
252	252	patient’s condition to persons representing themselves as relatives or friends of the patient or as a 24
253	253	representative of the news media. The access to confidential healthcare information to persons in 25
254	254	accredited educational programs under appropriate provider supervision shall not be deemed 26
255	255	subject to release or transfer of that information under subsection (a); 27
256	256	(23) To the workers’ compensation fraud prevention unit for purposes of investigation 28
257	257	under §§ 42-16.1-12 — 42-16.1-16. The release or transfer of confidential healthcare information 29
258	258	under any of the above exceptions is not the basis for any legal liability, civil or criminal, nor 30
259	259	considered a violation of this chapter; or 31
260	260	(24) To a probate court of competent jurisdiction, petitioner, respondent, and/or their 32
261	261	attorneys, when the information is contained within a decision-making assessment tool that 33
262	262	conforms to the provisions of § 33-15-47. 34
263	263
264	264
265	265	LC001364 - Page 8 of 10
266	266	(c) Third parties receiving, and retaining, a patient’s confidential healthcare information 1
267	267	must establish at least the following security procedures: 2
268	268	(1) Limit authorized access to personally identifiable confidential healthcare information 3
269	269	to persons having a “need to know” that information; additional employees or agents may have 4
270	270	access to that information that does not contain information from which an individual can be 5
271	271	identified; 6
272	272	(2) Identify an individual, or individuals, who have responsibility for maintaining security 7
273	273	procedures for confidential healthcare information; 8
274	274	(3) Provide a written statement to each employee or agent as to the necessity of maintaining 9
275	275	the security and confidentiality of confidential healthcare information, and of the penalties provided 10
276	276	for in this chapter for the unauthorized release, use, or disclosure of this information. The receipt 11
277	277	of that statement shall be acknowledged by the employee or agent, who signs and returns the 12
278	278	statement to his or her employer or principal, who retains the signed original. The employee or 13
279	279	agent shall be furnished with a copy of the signed statement; and 14
280	280	(4) Take no disciplinary or punitive action against any employee or agent solely for 15
281	281	bringing evidence of violation of this chapter to the attention of any person. 16
282	282	(d) Consent forms for the release or transfer of confidential healthcare information shall 17
283	283	contain, or in the course of an application or claim for insurance be accompanied by a notice 18
284	284	containing, the following information in a clear and conspicuous manner: 19
285	285	(1) A statement of the need for and proposed uses of that information; 20
286	286	(2) A statement that all information is to be released or clearly indicating the extent of the 21
287	287	information to be released; and 22
288	288	(3) A statement that the consent for release or transfer of information may be withdrawn at 23
289	289	any future time and is subject to revocation, except where an authorization is executed in connection 24
290	290	with an application for a life or health insurance policy in which case the authorization expires two 25
291	291	(2) years from the issue date of the insurance policy, and when signed in connection with a claim 26
292	292	for benefits under any insurance policy, the authorization shall be valid during the pendency of that 27
293	293	claim. Any revocation shall be transmitted in writing. 28
294	294	(e) Except as specifically provided by law, an individual’s confidential healthcare 29
295	295	information shall not be given, sold, transferred, or in any way relayed to any other person not 30
296	296	specified in the consent form or notice meeting the requirements of subsection (d) without first 31
297	297	obtaining the individual’s additional written consent on a form stating the need for the proposed 32
298	298	new use of this information or the need for its transfer to another person. 33
299	299	(f) Nothing contained in this chapter shall be construed to limit the permitted disclosure of 34
300	300
301	301
302	302	LC001364 - Page 9 of 10
303	303	confidential healthcare information and communications described in subsection (b). 1
304	304	SECTION 2. This act shall take effect upon passage. 2
305	305	========
306	306	LC001364
307	307	========
308	308
309	309
310	310	LC001364 - Page 10 of 10
311	311	EXPLANATION
312	312	BY THE LEGISLATIVE COUNCIL
313	313	OF
314	314	A N A C T
315	315	RELATING TO BUSINESSES AND PROFESSIONS -- CONFIDENTIALITY OF HEALTH
316	316	CARE COMMUNICATIONS AND INFORMATION ACT
317	317	***
318	318	This act would amend provisions relative to confidentiality of health care communications 1
319	319	and the process for requesting records and/or confidential health care information. 2
320	320	This act would take effect upon passage. 3
321	321	========
322	322	LC001364
323	323	========
324	324