Section 216-RICR-10-10-6.5 - Confidentiality Protections6.5.1Patients' RightsA. In addition to the requirements of R.I. Gen. Laws Chapter 5-37.7 and this Part, a patient participant who has his or her confidential health information in the HIE shall have the following rights:1. To obtain a copy of his or her confidential health information from the HIE by: a. Submitting a valid and authenticated request to access the HIE record via the methods made available by the RHIO.b. The form and methods shall be publicly available through posting on the HIE website including enrolling in any available patient portal.c. Requestors may also call the CurrentCare information line to complete and submit the information on the form over the phone. To do so, the requestor must successfully complete the requirements of the identity verification process by supplying identifying information through a series of questions initiated by a RHIO representative over the phone and for the sole purpose of a single occurrence of a telephone request to submit the form.d. If the requestor prefers, he or she may fill out a form in person at the RHIO offices after identity verification has occurred. The requestor may either obtain an enrollee request to access record form via the website or request a form be mailed to them.e. If neither is possible, then the requestor may send a letter containing the same information as is required by the form and have it authenticated in the same manner as the written form.2. To obtain a copy of the disclosure report pertaining to his or her confidential health information by submitting a request for a disclosure report. The forms along with information about where to submit the form shall be publicly available through posting on the HIE website; The RHIO will make every effort to provide disclosure reports in a prompt manner while recognizing that State and Federal law allow up to sixty (60) days to respond. If extenuating circumstances arise, the RHIO may have an additional thirty (30) days to provide the disclosure report to the enrollee. Each request for disclosure history will be addressed in accordance with 45 C.F.R. § 164.528. A charge for a copy of the disclosure report may be imposed if consistent with State law and 45 C.F.R. § 164.528. In accordance with 45 C.F.R. § 164.528(c)(2), the first (1st) disclosure report shall be provided to a patient participant in any twelve (12) month period at no cost to the patient participant.3. To be notified, if required by either R.I. Gen. Laws Chapter 11-49.2 [Rhode Island Identity Theft Protection Act], or the HIPAA Final Omnibus Rule, of a breach of the security system of the HIE that resulted in the unauthorized access, use or disclosure of personal information or unsecured protected health information.4. To opt out of having health information disclosed to health care providers through the HIE at any time in accordance with the Act and this Part by submitting an Opt-Out form to the RHIO. a. Opt-out forms provided by the HIE shall be broadly available and accessible through a variety of methods. At minimum, such methods must include paper forms submitted by fax or mail, and electronic submission by website.b. Opt-out forms shall be provided with appropriate accommodations to individuals experiencing disabilities, to the extent possible.c. Opt-out forms provided by the HIE shall be available in a multitude of languages reflecting those most commonly used by Rhode Island patients, including, but not limited to, English, Spanish, and Portuguese.d. Consent decisions of any type shall be recorded or indicated directly by the patient participant or his or her authorized representative, and not by a provider participant or other intermediary.5. A completed opt-out form may be revoked at any time ("opting in" again) in accordance with the Act and this Part. The form and methods for reversing an opt-out decision shall be publicly available through posting on the HIE website or the patient participant or authorized representative may call the RHIO to request a form be sent to them.6. Upon a patient participant's completed opt-out form the patient's confidential health information in the HIE will no longer be accessible to a provider participant. Nothing in this Part shall preclude a provider participant from accessing the provider participant's own record of the patient. A patient's decision to opt-out will not affect the previous disclosures or access to the patient's health information.a. A patient participant's opt-out form shall apply to any disclosure of protected health information to health care providers by the RHIO where that protected health information was obtained due to designation as the RHIO, except as otherwise described for temporary access in an emergency.7. Since the HIE does not create patient confidential health information, but receives confidential health information from provider participants, the patient participant may request to amend his or her own information through provider participants by submitting a request to amend confidential health information form consistent with this Part. The form and methods shall be publicly available through posting on the HIE website or the patient participant or authorized representative may call the RHIO to request a form be sent to them. The RHIO will respond directly to a patient participant request and follow its policies and procedures if there is an administrative error that does not require an amendment to the record received from the provider participant.8. Following any health care provider's temporary access of a patient participant's protected health information via emergency procedures in the HIE, the health care provider shall notify the patient participant or his or her authorized representative of the temporary access as soon as is feasible. The temporary access shall not extend beyond the duration of the emergency. The health care provider or facility treating the emergency shall determine the existence of a medical emergency, its duration, and which personnel are needed to address the medical emergency.6.5.2Confidentiality ProtectionsA. Confidentiality protections for patient participants in the HIE are pursuant to R.I. Gen. Laws Chapter 5-37.7 and this Part. The RHIO shall submit the policies and procedures described in §6.3.2(A) to the Department upon request and at least annually. 1. Confidentiality protections for patient participants in the HIE are also pursuant to R.I. Gen. Laws § 40.1-5-26, 45 C.F.R. § 164.528 and 42 C.F.R. Part 2.6.5.3Secondary DisclosureSecondary disclosure Rules shall be pursuant to those stated in R.I. Gen. Laws § 5-37.7-9.
6.5.4Opt-Out FormA. The opt-out form for opting out of access to, or the disclosure, release or transfer of, confidential health information from the HIE shall conform with the requirements of R.I. Gen. Laws Chapter 5-37.7; and additionally contain other information required by the RHIO, in consultation with the HIE Advisory Commission and the Director.B. Except as specifically set forth in R.I. Gen. Laws § 5-37.7-7(b), the RHIO shall not allow access to or disclosure of a patient participant's confidential health information unless it is in accordance with the patient participant's authorization.C. Except as set forth in R.I. Gen. Laws § 5-37.7-7(b), the RHIO will not allow access to or disclosure of a patient participant's confidential health information to a provider participant unless the recipient has entered into a Data Use Agreement with the RHIO.D. The RHIO shall not accept or respond to any authorization for requesting disclosure of the patient participant's health information for any purpose other than as set forth by the Act and this Part.E. Any request to opt-out from the HIE pursuant to §6.5.1 of this Part shall be on forms which are provided by the RHIO in accordance with §6.5.1 of this Part. Requests to opt out from the HIE shall be made in accordance with §6.5.1(A)(6) of this Part.6.5.5Release of Confidential Health Information in Conjunction with Legal ProceedingsRelease of confidential health information in conjunction with legal proceedings shall occur pursuant to R.I. Gen. Laws Chapter 5-37.7.
216 R.I. Code R. 216-RICR-10-10-6.5
Amended effective 12/8/2022