Rhode Island Code of Regulations
Title 216 - Department of health
Chapter 10 - Public Health Administration
Subchapter 10 - Registries
Part 6 - Regional Health Information Organization and Health Information Exchange
Section 216-RICR-10-10-6.5 - Confidentiality Protections

1. To obtain a copy of his or her confidential health information from the HIE by:

2. To obtain a copy of the disclosure report pertaining to his or her confidential health information by submitting a request for a disclosure report. The forms along with information about where to submit the form shall be publicly available through posting on the HIE website; The RHIO will make every effort to provide disclosure reports in a prompt manner while recognizing that State and Federal law allow up to sixty (60) days to respond. If extenuating circumstances arise, the RHIO may have an additional thirty (30) days to provide the disclosure report to the enrollee. Each request for disclosure history will be addressed in accordance with 45 C.F.R. § 164.528. A charge for a copy of the disclosure report may be imposed if consistent with State law and 45 C.F.R. § 164.528. In accordance with 45 C.F.R. § 164.528(c)(2), the first (1st) disclosure report shall be provided to a patient participant in any twelve (12) month period at no cost to the patient participant.

3. To be notified, if required by either R.I. Gen. Laws Chapter 11-49.2 [Rhode Island Identity Theft Protection Act], or the HIPAA Final Omnibus Rule, of a breach of the security system of the HIE that resulted in the unauthorized access, use or disclosure of personal information or unsecured protected health information.

4. To opt out of having health information disclosed to health care providers through the HIE at any time in accordance with the Act and this Part by submitting an Opt-Out form to the RHIO.

5. A completed opt-out form may be revoked at any time ("opting in" again) in accordance with the Act and this Part. The form and methods for reversing an opt-out decision shall be publicly available through posting on the HIE website or the patient participant or authorized representative may call the RHIO to request a form be sent to them.

6. Upon a patient participant's completed opt-out form the patient's confidential health information in the HIE will no longer be accessible to a provider participant. Nothing in this Part shall preclude a provider participant from accessing the provider participant's own record of the patient. A patient's decision to opt-out will not affect the previous disclosures or access to the patient's health information.

7. Since the HIE does not create patient confidential health information, but receives confidential health information from provider participants, the patient participant may request to amend his or her own information through provider participants by submitting a request to amend confidential health information form consistent with this Part. The form and methods shall be publicly available through posting on the HIE website or the patient participant or authorized representative may call the RHIO to request a form be sent to them. The RHIO will respond directly to a patient participant request and follow its policies and procedures if there is an administrative error that does not require an amendment to the record received from the provider participant.

8. Following any health care provider's temporary access of a patient participant's protected health information via emergency procedures in the HIE, the health care provider shall notify the patient participant or his or her authorized representative of the temporary access as soon as is feasible. The temporary access shall not extend beyond the duration of the emergency. The health care provider or facility treating the emergency shall determine the existence of a medical emergency, its duration, and which personnel are needed to address the medical emergency.

1. Confidentiality protections for patient participants in the HIE are also pursuant to R.I. Gen. Laws § 40.1-5-26, 45 C.F.R. § 164.528 and 42 C.F.R. Part 2.