§ 5-37.7-7. Disclosure.
(a)(1) Except as provided in subsection (b), a patient participant's confidential health care information may only be accessed, released, or transferred from the HIE in accordance with an authorization form signed by the patient participant or the patient's authorized representative.
(b) No authorization for release or transfer of confidential health care information from the HIE shall be required in the following situations:
(1) To a health care provider who believes, in good faith, that the information is necessary for diagnosis or treatment of that individual in an emergency; or
(2) To public health authorities in order to carry out their functions as described in this title and titles 21 and 23, and rules promulgated under those titles. These functions include, but are not restricted to, investigations into the causes of disease, the control of public health hazards, enforcement of sanitary laws, investigation of reportable diseases, certification and licensure of health professionals and facilities, review of health care such as that required by the federal government and other governmental agencies, and mandatory reporting laws set forth in Rhode Island general laws; or
(3) To the RHIO in order for it to effectuate the operation and administrative oversight of the HIE; and
(4) To a health plan, if the information is necessary for care management of its plan members, or for quality and performance measure reporting.
(c) The content of the authorization form for access to, or the disclosure, release, or transfer of confidential health care information from the HIE, shall be prescribed by the RHIO in accordance with applicable department of health regulations, but, at a minimum, shall contain the following information in a clear and conspicuous manner:
(1) A statement of the need for and proposed uses of that information; and
(2) A statement that the authorization for access to, disclosure of, and/or release of information may be withdrawn at any future time and is subject to revocation;
(3) That the patient has the right not to participate in the HIE; and
(4) The patient's right to choose to: (i) Enroll in and participate fully in the HIE; or (ii) Designate only specific health care providers that may access the patient participant's confidential health care information.
(d) Except as specifically provided by law or this chapter, or use for clinical care, a patient participant's confidential health care information shall not be accessed by, given, sold, transferred, or in any way relayed from the HIE to any other person or entity not specified in the patient participant authorization form meeting the requirements of subsection (c) without first obtaining additional authorization.
(e) Nothing contained in this chapter shall be construed to limit the permitted access to, or the release, transfer, access or disclosure of, confidential health care information described in subsection (b) or under other applicable law.
(f) Confidential health care information received, disclosed, or held by the HIE shall not be subject to subpoena directed to the HIE or RHIO unless the following procedures have been completed: (i) The person seeking the confidential health care information has already requested and received the confidential health care information from the health care provider that was the original source of the information; and (ii) A determination has been made by the superior court, upon motion and notice to the HIE or RHIO and the parties to the litigation in which the subpoena is served, that the confidential health care information sought from the HIE is not available from another source and is either relevant to the subject matter involved in the pending action or is reasonably calculated to lead to the discovery of admissible evidence in such pending action. Any person issuing a subpoena to the HIE or RHIO pursuant to this section shall certify that such measures have been completed prior to the issuance of the subpoena.
(g) Nothing contained herein shall interfere with, or impact upon, any rights or obligations imposed by the Workers Compensation Act as contained in chapters 29-38 of title 28.
(h) Nothing contained herein shall prohibit a health plan from becoming a data-submitting partner. A data-submitting partner is not considered a managed care entity or a managed care contractor and the HIE is not considered a regional or local medical information database pursuant to § 5-37.3-4.
(P.L. 2008, ch. 171, § 2; P.L. 2008, ch. 466, § 2; P.L. 2016, ch. 67, § 1; P.L. 2016, ch. 71, § 1.)