Rhode Island General Laws Title 5. Businesses and Professions § 5-37.7-4. Use of the health information exchange

(a) There shall be established a statewide HIE under state authority to allow for the electronic mobilization of confidential healthcare information in Rhode Island. Confidential healthcare information may only be accessed, released, or transferred from the HIE in accordance with this chapter.

(b) The state has an interest in encouraging use of the HIE by all interested parties, including, but not limited to, healthcare providers, patients, health plans, entities submitting information to the HIE, entities obtaining information from the HIE, and the RHIO.

(c) Except as provided in § 5-37.7-7(b), patients shall have the choice to opt out of having their confidential healthcare information disclosed from the HIE through the process defined in regulations in accordance with § 5-37.7-5.

(d) Provider participants must continue to maintain their own medical record meeting the documentation and other standards imposed by otherwise applicable law.

(e) The state agencies may submit to the HIE and/or receive from the HIE applicable confidential healthcare information for public health purposes.

(f) Nothing contained herein shall have an impact on the content of, or use or disclosure of, confidential healthcare information of patients that is held in locations other than the HIE. Nothing in this chapter shall be construed to limit, change, or otherwise affect entities' rights to exchange confidential healthcare information in accordance with other applicable laws.

(g) The state hereby imposes on the HIE and the RHIO as a matter of state law, the obligation to maintain, and abide by the terms of, HIPAA-compliant business associate agreements, including, without limitation, the obligations to use appropriate safeguards to prevent use or disclosure of confidential healthcare information in accordance with HIPAA, other state and federal laws, and this chapter; not to use or disclose confidential healthcare information other than as permitted by HIPAA and this chapter; or to make any amendment to a confidential healthcare record that a provider participant so directs; and to respond to a request by a patient to make an amendment to the patient's healthcare record.