§ 5-37.7-4. Use of the health information exchange.
(a) There shall be established a statewide HIE under state authority to allow for the
electronic mobilization of confidential healthcare information in Rhode Island. Confidential
healthcare information may only be accessed, released, or transferred from the HIE
in accordance with this chapter.
(b) The state has an interest in encouraging use of the HIE by all interested parties,
including, but not limited to, healthcare providers, patients, health plans, entities
submitting information to the HIE, entities obtaining information from the HIE, and
the RHIO.
(c) Except as provided in § 5-37.7-7(b), patients shall have the choice to opt out of having their confidential healthcare
information disclosed from the HIE through the process defined in regulations in accordance
with § 5-37.7-5.
(d) Provider participants must continue to maintain their own medical record meeting the
documentation and other standards imposed by otherwise applicable law.
(e) The state agencies may submit to the HIE and/or receive from the HIE applicable confidential
healthcare information for public health purposes.
(f) Nothing contained herein shall have an impact on the content of, or use or disclosure
of, confidential healthcare information of patients that is held in locations other
than the HIE. Nothing in this chapter shall be construed to limit, change, or otherwise
affect entities' rights to exchange confidential healthcare information in accordance
with other applicable laws.
(g) The state hereby imposes on the HIE and the RHIO as a matter of state law, the obligation
to maintain, and abide by the terms of, HIPAA-compliant business associate agreements,
including, without limitation, the obligations to use appropriate safeguards to prevent
use or disclosure of confidential healthcare information in accordance with HIPAA,
other state and federal laws, and this chapter; not to use or disclose confidential
healthcare information other than as permitted by HIPAA and this chapter; or to make
any amendment to a confidential healthcare record that a provider participant so directs;
and to respond to a request by a patient to make an amendment to the patient's healthcare
record.