Confidentiality of Health Care Communications and Information Act

RI CHCCIA

Health · Employees · Financial

Rhode Island's general medical privacy law. It bars providers and anyone who receives patient information from releasing or re-disclosing confidential health care information without the patient's written consent on a compliant form, subject to listed exceptions such as emergencies, treatment coordination, insurers, research without identification and certain law-enforcement reports. It also gives patients rights to have adverse-decision records sent to a physician, to seek amendment, and to have insurers send communications to an address they choose.

Where: Rhode Island
Citation: R.I. Gen. Laws §§ 5-37.3-1 to 5-37.3-12
Status: In force
Last amended: 2024-06-26
Enforced by: Courts via patient suits; criminal prosecution
People can sue: Yes
Penalties: Violators are liable for actual and exemplary (punitive) damages, with discretionary attorney's fees (§§ 5-37.3-4(a)(2)-(3), 5-37.3-9). Knowing and intentional unauthorized release under § 5-37.3-4 is punishable by a fine up to $5,000 and/or up to 6 months in prison per violation; other intentional violations up to $1,000 and/or 6 months (§ 5-37.3-9(b)). Waivers are void.
Applies to: Health care providers licensed in or lawfully providing health care services in Rhode Island, and their employees and agents
Third parties (anyone other than the patient or a provider, such as insurers and employers) that receive or retain confidential health care information
Managed care entities and health insurers (enrollee data restrictions and confidential-communication requests)

What a privacy notice must say

Consent forms (or insurance-application notices) must clearly state the need for and proposed uses of the information, the extent of information released, and that consent is revocable in writing (insurance-application authorizations expire two years after policy issue).R.I. Gen. Laws § 5-37.3-4(d)

Rights it gives people

Providers must transfer copies of diagnostic test results to a subsequent provider on written request of the patient, representative or treating physician.R.I. Gen. Laws § 5-37.3-5.1
Health insurers must honor an insured's confidential communications request to receive communications containing health information at a designated mail or email address or phone number, valid until revoked.R.I. Gen. Laws § 5-37.3-12(b) · From 2022-01-01
After an adverse insurance or employment decision based on health information, a patient may require the third party to send copies of the information to a designated physician, request amendment through the originating provider, and add a statement of disagreement to the file.R.I. Gen. Laws § 5-37.3-5(a)-(d)

Practices it requires

Recipients may not give, sell or relay health information to anyone not named in the consent form without the patient's additional written consent stating the new use or transfer.R.I. Gen. Laws § 5-37.3-4(e)
Managed care entities and contractors may not provide identifiable enrollee information that is not essential for statistical compilation to any international, national, regional or local medical-information database.R.I. Gen. Laws § 5-37.3-4(a)(1)
Do not release or transfer a patient's confidential health care information without the written consent of the patient or authorized representative, except in the situations listed in § 5-37.3-4(b).R.I. Gen. Laws § 5-37.3-4(a)(1), (b)

Other duties

Confidential health care information and communications are generally protected from compelled disclosure in court, legislative and administrative proceedings, subject to listed exceptions.R.I. Gen. Laws §§ 5-37.3-6 to 5-37.3-6.2

Sources

Checked against these sources on 2026-09-25 by research agent (Claude), primary sources.

Unverified: Original effective date of P.L. 1978, ch. 297 not confirmed. last_amended reflects P.L. 2024, chs. 352 and 353 (amending § 5-37.3-3), effective June 26, 2024.

Research reference, not legal advice.