(a) Except as provided in subsection (b), a patient or the patient's authorized representative may opt out of having the patient's confidential healthcare information disclosed from the HIE. Patients shall be notified of their right to opt out of having their confidential healthcare information disclosed from the HIE through the process provided by regulation in accordance with § 5-37.7-5.
(b) The opt out does not apply to disclosures in the following situations:
(1) To a healthcare provider who believes, in good faith, that the information is necessary for diagnosis or treatment of that individual in an emergency; or
(2) To public health authorities in order to carry out their functions as described in this title and titles 21 and 23, and rules promulgated under those titles. These functions include, but are not restricted to: investigations into the causes of disease; the control of public-health hazards; enforcement of sanitary laws; investigation of reportable diseases; certification and licensure of health professionals and facilities; review of health care such as that required by the federal government and other governmental agencies; and mandatory reporting laws set forth in Rhode Island general laws; or
(3) To the RHIO in order for it to effectuate the operation and administrative oversight of the HIE; and
(4) To a health plan, if the information is necessary for care management of its plan members, or for quality and performance measure reporting.
(c) Notification and opt out procedures shall be developed in consultation with the HIE advisory commission and provided in regulations promulgated in accordance with § 5-37.7-5. Provider participants who or that share data with the HIE shall notify their patients that data is being shared with the HIE to support the provision of care, and inform their patients about the ability to opt out. At a minimum, the notification shall contain the following information in a clear and concise manner:
(1) A statement that the patient's provider is a provider participant in the HIE, and as such may share the patient's confidential healthcare information through the HIE as permitted by this chapter and all applicable state and federal law.
(2) A statement that the patient may opt out of having their confidential healthcare information disclosed from the HIE except as provided pursuant to subsection (b) of this section.
(3) A statement that a patient's choice to opt out of disclosing their confidential healthcare information from the HIE may be changed at any time.
(4) The method for opting out shall be provided by regulation in accordance with § 5-37.7-5.
(d) Except as specifically provided by state or federal law or this chapter, a patient's confidential healthcare information shall not be accessed by, given, sold, transferred, or in any way relayed from the HIE to any other person or entity.
(e) [Deleted by P.L. 2021, ch. 362, § 1 and P.L. 2021, ch. 364, § 1.]
(f) Confidential healthcare information received, disclosed, or held by the HIE shall not be subject to subpoena directed to the HIE or RHIO unless the following procedures have been completed: (i) The person seeking the confidential healthcare information has already requested and received the confidential healthcare information from the healthcare provider that was the original source of the information; and (ii) A determination has been made by the superior court, upon motion and notice to the HIE or RHIO and the parties to the litigation in which the subpoena is served, that the confidential healthcare information sought from the HIE is not available from another source and is either relevant to the subject matter involved in the pending action or is reasonably calculated to lead to the discovery of admissible evidence in such pending action. Any person issuing a subpoena to the HIE or RHIO pursuant to this section shall certify that such measures have been completed prior to the issuance of the subpoena.
(g) Nothing contained herein shall interfere with, or impact upon, any rights or obligations imposed by the Workers' Compensation Act as contained in chapters 29 through 38 of title 28.
(h) Nothing contained herein shall prohibit a health plan from becoming a data-submitting partner. A data-submitting partner is not considered a managed-care entity or a managed-care contractor, and the HIE is not considered a regional or local medical information database pursuant to § 5-37.3-4.
History of Section.
P.L. 2008, ch. 171, § 2; P.L. 2008, ch. 466, § 2; P.L. 2016, ch. 67, § 1; P.L. 2016, ch. 71, § 1; P.L. 2021, ch. 362, § 1, effective July 12, 2021; P.L. 2021, ch. 364, § 1, effective July 12, 2021.