§ 5-37.7-7. Disclosure. (a)(1) Except as provided in subsection (b), a patient participant's confidential healthcare information may only be accessed, released, or transferred from the HIE in accordance with an authorization form signed by the patient participant or the patient's authorized representative.

(b) No authorization for release or transfer of confidential healthcare information from the HIE shall be required in the following situations:

(1) To a healthcare provider who believes, in good faith, that the information is necessary for diagnosis or treatment of that individual in an emergency; or

(2) To public-health authorities in order to carry out their functions as described in this title and titles 21 and 23, and rules promulgated under those titles. These functions include, but are not restricted to, investigations into the causes of disease, the control of public-health hazards, enforcement of sanitary laws, investigation of reportable diseases, certification and licensure of health professionals and facilities, review of health care such as that required by the federal government and other governmental agencies, and mandatory reporting laws set forth in Rhode Island general laws; or

(3) To the RHIO in order for it to effectuate the operation and administrative oversight of the HIE; and

(4) To a health plan, if the information is necessary for care management of its plan members, or for quality and performance measure reporting.

(c) The content of the authorization form for access to, or the disclosure, release, or transfer of confidential healthcare information from the HIE, shall be prescribed by the RHIO in accordance with applicable department of health regulations, but, at a minimum, shall contain the following information in a clear and conspicuous manner:

(1) A statement of the need for and proposed uses of that information; and

(2) A statement that the authorization for access to, disclosure of, and/or release of information may be withdrawn at any future time and is subject to revocation;

(3) That the patient has the right not to participate in the HIE; and

(4) The patient's right to choose to: (i) Enroll in and participate fully in the HIE; or (ii) Designate only specific healthcare providers that may access the patient participant's confidential healthcare information.

(d) Except as specifically provided by law or this chapter, or use for clinical care, a patient participant's confidential healthcare information shall not be accessed by, given, sold, transferred, or in any way relayed from the HIE to any other person or entity not specified in the patient participant authorization form meeting the requirements of subsection (c) without first obtaining additional authorization.

(e) Nothing contained in this chapter shall be construed to limit the permitted access to, or the release, transfer, access, or disclosure of, confidential healthcare information described in subsection (b) or under other applicable law.

(f) Confidential healthcare information received, disclosed, or held by the HIE shall not be subject to subpoena directed to the HIE or RHIO unless the following procedures have been completed: (i) The person seeking the confidential healthcare information has already requested and received the confidential healthcare information from the healthcare provider that was the original source of the information; and (ii) A determination has been made by the superior court, upon motion and notice to the HIE or RHIO and the parties to the litigation in which the subpoena is served, that the confidential healthcare information sought from the HIE is not available from another source and is either relevant to the subject matter involved in the pending action or is reasonably calculated to lead to the discovery of admissible evidence in such pending action. Any person issuing a subpoena to the HIE or RHIO pursuant to this section shall certify that such measures have been completed prior to the issuance of the subpoena.

(g) Nothing contained herein shall interfere with, or impact upon, any rights or obligations imposed by the Workers' Compensation Act as contained in chapters 29 - 38 of title 28.

(h) Nothing contained herein shall prohibit a health plan from becoming a data-submitting partner. A data-submitting partner is not considered a managed-care entity or a managed-care contractor, and the HIE is not considered a regional or local medical information database pursuant to § 5-37.3-4.

History of Section. (P.L. 2008, ch. 171, § 2; P.L. 2008, ch. 466, § 2; P.L. 2016, ch. 67, § 1; P.L. 2016, ch. 71, § 1.)