§ 5-37.3-4 - Limitations on and permitted disclosures.
SECTION 5-37.3-4
§ 5-37.3-4 Limitations on and permitteddisclosures. – (a) Except as provided in subsection (b) of this section or as specificallyprovided by the law, a patient's confidential health care information shall notbe released or transferred without the written consent of the patient or his orher authorized representative, on a consent form meeting the requirements ofsubsection (d) of this section. A copy of any notice used pursuant tosubsection (d) of this section, and of any signed consent shall, upon request,be provided to the patient prior to his or her signing a consent form. Any andall managed care entities and managed care contractors writing policies in thestate shall be prohibited from providing any information related to enrolleeswhich is personal in nature and could reasonably lead to identification of anindividual and is not essential for the compilation of statistical data relatedto enrollees, to any international, national, regional, or local medicalinformation data base. This provision shall not restrict or prohibit thetransfer of information to the department of health to carry out its statutoryduties and responsibilities.
(2) Any person who violates the provisions of this sectionmay be liable for actual and punitive damages.
(3) The court may award a reasonable attorney's fee at itsdiscretion to the prevailing party in any civil action under this section.
(4) Any person who knowingly and intentionally violates theprovisions of this section shall, upon conviction, be fined not more than fivethousand ($5,000) dollars for each violation, or imprisoned not more than six(6) months for each violation, or both.
(5) Any contract or agreement which purports to waive theprovisions of this section shall be declared null and void as against publicpolicy.
(b) No consent for release or transfer of confidential healthcare information shall be required in the following situations:
(1) To a physician, dentist, or other medical personnel whobelieves, in good faith, that the information is necessary for diagnosis ortreatment of that individual in a medical or dental emergency;
(2) To medical and dental peer review boards, or the board ofmedical licensure and discipline, or board of examiners in dentistry;
(3) To qualified personnel for the purpose of conductingscientific research, management audits, financial audits, program evaluations,actuarial, insurance underwriting, or similar studies; provided, that personnelshall not identify, directly or indirectly, any individual patient in anyreport of that research, audit, or evaluation, or otherwise disclose patientidentities in any manner;
(4) By a health care provider to appropriate law enforcementpersonnel, or to a person if the health care provider believes that person orhis or her family is in danger from a patient; or to appropriate lawenforcement personnel if the patient has or is attempting to obtain narcoticdrugs from the health care provider illegally; or to appropriate lawenforcement personnel or appropriate child protective agencies if the patientis a minor child who the health care provider believes, after providing healthcare services to the patient, to have been physically or psychologicallyabused; or to law enforcement personnel in the case of a gunshot woundreportable under § 11-47-48;
(5) Between or among qualified personnel and health careproviders within the health care system for purposes of coordination of healthcare services given to the patient and for purposes of education and trainingwithin the same health care facility; or
(6) To third party health insurers including to utilizationreview agents as provided by § 23-17.12-9(c)(4), third partyadministrators licensed pursuant to chapter 20.7 of title 27 and other entitiesthat provide operational support to adjudicate health insurance claims oradminister health benefits;
(7) To a malpractice insurance carrier or lawyer if thehealth care provider has reason to anticipate a medical liability action; or
(8) To the health care provider's own lawyer or medicalliability insurance carrier if the patient whose information is at issue bringsa medical liability action against a health care provider.
(ii) Disclosure by a health care provider of a patient'shealth care information which is relevant to a civil action brought by thepatient against any person or persons other than that health care provider mayoccur only under the discovery methods provided by the applicable rules ofcivil procedure (federal or state). This disclosure shall not be through exparte contacts and not through informal ex parte contacts with the provider bypersons other than the patient or his or her legal representative. Nothing inthis section shall limit the right of a patient or his or her attorney toconsult with that patient's own physician and to obtain that patient's ownhealth care information;
(9) To public health authorities in order to carry out theirfunctions as described in this title and titles 21 and 23, and rulespromulgated under those titles. These functions include, but are not restrictedto, investigations into the causes of disease, the control of public healthhazards, enforcement of sanitary laws, investigation of reportable diseases,certification and licensure of health professionals and facilities, review ofhealth care such as that required by the federal government and othergovernmental agencies;
(10) To the state medical examiner in the event of a fatalitythat comes under his or her jurisdiction;
(11) In relation to information that is directly related tocurrent claim for workers' compensation benefits or to any proceeding beforethe workers' compensation commission or before any court proceeding relating toworkers' compensation;
(12) To the attorneys for a health care provider wheneverthat provider considers that release of information to be necessary in order toreceive adequate legal representation;
(13) By a health care provider to appropriate schoolauthorities of disease, health screening and/or immunization informationrequired by the school; or when a school age child transfers from one school orschool district to another school or school district;
(14) To a law enforcement authority to protect the legalinterest of an insurance institution, agent, or insurance-support organizationin preventing and prosecuting the perpetration of fraud upon them;
(15) To a grand jury or to a court of competent jurisdictionpursuant to a subpoena or subpoena duces tecum when that information isrequired for the investigation or prosecution of criminal wrongdoing by ahealth care provider relating to his or her or its provisions of health careservices and that information is unavailable from any other source; provided,that any information so obtained is not admissible in any criminal proceedingagainst the patient to whom that information pertains;
(16) To the state board of elections pursuant to a subpoenaor subpoena duces tecum when that information is required to determine theeligibility of a person to vote by mail ballot and/or the legitimacy of acertification by a physician attesting to a voter's illness or disability;
(17) To certify, pursuant to chapter 20 of title 17, thenature and permanency of a person's illness or disability, the date when thatperson was last examined and that it would be an undue hardship for the personto vote at the polls so that the person may obtain a mail ballot;
(18) To the central cancer registry;
(19) To the Medicaid fraud control unit of the attorneygeneral's office for the investigation or prosecution of criminal or civilwrongdoing by a health care provider relating to his or her or its provision ofhealth care services to then Medicaid eligible recipients or patients,residents, or former patients or residents of long term residential carefacilities; provided, that any information obtained shall not be admissible inany criminal proceeding against the patient to whom that information pertains;
(20) To the state department of children, youth, and familiespertaining to the disclosure of health care records of children in the custodyof the department;
(21) To the foster parent or parents pertaining to thedisclosure of health care records of children in the custody of the fosterparent or parents; provided, that the foster parent or parents receiveappropriate training and have ongoing availability of supervisory assistance inthe use of sensitive information that may be the source of distress to thesechildren;
(22) A hospital may release the fact of a patient's admissionand a general description of a patient's condition to persons representingthemselves as relatives or friends of the patient or as a representative of thenews media. The access to confidential health care information to persons inaccredited educational programs under appropriate provider supervision shallnot be deemed subject to release or transfer of that information undersubsection (a) of this section; or
(23) To the workers' compensation fraud prevention unit forpurposes of investigation under §§ 42-16.1-12 – 42-16.1-16. Therelease or transfer of confidential health care information under any of theabove exceptions is not the basis for any legal liability, civil or criminal,nor considered a violation of this chapter; or
(24) To a probate court of competent jurisdiction,petitioner, respondent, and/or their attorneys, when the information iscontained within a decision-making assessment tool which conforms to theprovisions of § 33-15-47.
(c) Third parties receiving and retaining a patient'sconfidential health care information must establish at least the followingsecurity procedures:
(1) Limit authorized access to personally identifiableconfidential health care information to persons having a "need to know" thatinformation; additional employees or agents may have access to that informationwhich does not contain information from which an individual can be identified;
(2) Identify an individual or individuals who haveresponsibility for maintaining security procedures for confidential health careinformation;
(3) Provide a written statement to each employee or agent asto the necessity of maintaining the security and confidentiality ofconfidential health care information, and of the penalties provided for in thischapter for the unauthorized release, use, or disclosure of this information.The receipt of that statement shall be acknowledged by the employee or agent,who signs and returns the statement to his or her employer or principal, whoretains the signed original. The employee or agent shall be furnished with acopy of the signed statement;
(4) Take no disciplinary or punitive action against anyemployee or agent solely for bringing evidence of violation of this chapter tothe attention of any person.
(d) Consent forms for the release or transfer of confidentialhealth care information shall contain, or in the course of an application orclaim for insurance be accompanied by a notice containing, the followinginformation in a clear and conspicuous manner:
(1) A statement of the need for and proposed uses of thatinformation;
(2) A statement that all information is to be released orclearly indicating the extent of the information to be released; and
(3) A statement that the consent for release or transfer ofinformation may be withdrawn at any future time and is subject to revocation,except where an authorization is executed in connection with an application fora life or health insurance policy in which case the authorization expires two(2) years from the issue date of the insurance policy, and when signed inconnection with a claim for benefits under any insurance policy theauthorization shall be valid during the pendency of that claim. Any revocationshall be transmitted in writing.
(e) Except as specifically provided by law, an individual'sconfidential health care information shall not be given, sold, transferred, orin any way relayed to any other person not specified in the consent form ornotice meeting the requirements of subsection (d) of this section without firstobtaining the individual's additional written consent on a form stating theneed for the proposed new use of this information or the need for its transferto another person.
(f) Nothing contained in this chapter shall be construed tolimit the permitted disclosure of confidential health care information andcommunications described in subsection (b) of this section.