§ 5-37.7-7. Disclosure.
(a) Except as provided in subsection (b), a patient or the patient's authorized representative
may opt out of having the patient's confidential healthcare information disclosed
from the HIE. Patients shall be notified of their right to opt out of having their
confidential healthcare information disclosed from the HIE through the process provided
by regulation in accordance with § 5-37.7-5.
(b) The opt out does not apply to disclosures in the following situations:
(1) To a healthcare provider who believes, in good faith, that the information is necessary
for diagnosis or treatment of that individual in an emergency; or
(2) To public health authorities in order to carry out their functions as described in
this title and titles 21 and 23, and rules promulgated under those titles. These functions
include, but are not restricted to: investigations into the causes of disease; the
control of public-health hazards; enforcement of sanitary laws; investigation of reportable
diseases; certification and licensure of health professionals and facilities; review
of health care such as that required by the federal government and other governmental
agencies; and mandatory reporting laws set forth in Rhode Island general laws; or
(3) To the RHIO in order for it to effectuate the operation and administrative oversight
of the HIE; and
(4) To a health plan, if the information is necessary for care management of its plan
members, or for quality and performance measure reporting.
(c) Notification and opt out procedures shall be developed in consultation with the HIE
advisory commission and provided in regulations promulgated in accordance with § 5-37.7-5. Provider participants who or that share data with the HIE shall notify their patients
that data is being shared with the HIE to support the provision of care, and inform
their patients about the ability to opt out. At a minimum, the notification shall
contain the following information in a clear and concise manner:
(1) A statement that the patient's provider is a provider participant in the HIE, and
as such may share the patient's confidential healthcare information through the HIE
as permitted by this chapter and all applicable state and federal law.
(2) A statement that the patient may opt out of having their confidential healthcare information
disclosed from the HIE except as provided pursuant to subsection (b) of this section.
(3) A statement that a patient's choice to opt out of disclosing their confidential healthcare
information from the HIE may be changed at any time.
(4) The method for opting out shall be provided by regulation in accordance with § 5-37.7-5.
(d) Except as specifically provided by state or federal law or this chapter, a patient's
confidential healthcare information shall not be accessed by, given, sold, transferred,
or in any way relayed from the HIE to any other person or entity.
(e) [Deleted by P.L. 2021, ch. 362, § 1 and P.L. 2021, ch. 364, § 1.]
(f) Confidential healthcare information received, disclosed, or held by the HIE shall
not be subject to subpoena directed to the HIE or RHIO unless the following procedures
have been completed: (i) The person seeking the confidential healthcare information
has already requested and received the confidential healthcare information from the
healthcare provider that was the original source of the information; and (ii) A determination
has been made by the superior court, upon motion and notice to the HIE or RHIO and
the parties to the litigation in which the subpoena is served, that the confidential
healthcare information sought from the HIE is not available from another source and
is either relevant to the subject matter involved in the pending action or is reasonably
calculated to lead to the discovery of admissible evidence in such pending action.
Any person issuing a subpoena to the HIE or RHIO pursuant to this section shall certify
that such measures have been completed prior to the issuance of the subpoena.
(g) Nothing contained herein shall interfere with, or impact upon, any rights or obligations
imposed by the Workers' Compensation Act as contained in chapters 29 through 38 of
title 28.
(h) Nothing contained herein shall prohibit a health plan from becoming a data-submitting
partner. A data-submitting partner is not considered a managed-care entity or a managed-care
contractor, and the HIE is not considered a regional or local medical information
database pursuant to § 5-37.3-4.