It is enacted by the General Assembly as follows:
SECTION 1. Title 23 of the General Laws entitled "HEALTH AND SAFETY" is hereby amended by adding thereto the following chapter: 23-106-1. Definitions. For purposes of this chapter:
(1) “De-identified data” means data from which identifiers have been removed in accordance with applicable state and federal standards such that the data cannot reasonably be used to identify an individual.
(2) “Line-level data” means reportable disease data that includes direct or indirect identifiers, or that can reasonably be used to identify an individual case, contact, or reporting entity. Individual-level or line-level data can also be known as record-level data.
(3) “Public health purpose” means activities necessary to prevent or control disease, injury, or disability including, but not limited to public health surveillance, investigation, outbreak response, intervention, and evaluation.
(4) “Reportable disease data” means any information, record, laboratory result, medical record, or other data collected or maintained by Rhode Island department of health (“department”) pursuant to state law or regulation for the purpose of disease reporting, surveillance, investigation, control, or prevention. 23-106-2. Confidentiality of reportable disease data.
(a) All reportable disease data, including line-level data, in the possession or control of the department shall be confidential and shall not be considered a public record.
(b) Such data shall not be disclosed, subpoenaed, or otherwise released except as expressly authorized in § 23-106-3 or as required by federal law.
(c) The confidentiality protections in this section apply regardless of the format of the data, including paper records, electronic records, and databases. 23-106-3. Authority and permitted releases.
(a) The Rhode Island department of health is the sole authority responsible for determining access to, confidentiality of, and release of reportable disease data. No other state agency, political subdivision, or entity shall release reportable disease line-level data without written authorization by the department.
(b) The department may release de-identified reportable disease line-level data only when necessary for a public health purpose, including:
(1) Sharing with other local, state, tribal, territorial, or federal public health authorities (including the Centers for Disease Control and Prevention) for surveillance, investigation, or control activities;
(2) Sharing with healthcare facilities, laboratories, or providers as needed for case management, outbreak control, or prevention;
(3) Sharing with researchers or partners pursuant to a department-approved data use agreement that limits use to a public health purpose and prohibits re-identification or re-disclosure; or
(4) As otherwise required by federal law.
(c) The department may release de-identified data or aggregate statistical reports when the department determines such release is in the public interest and does not create a reasonable risk of re-identification. 23-106-4. Limitations on disclosure.
(a) Line-level reportable disease data shall not be released for purposes unrelated to public health, including litigation, commercial purposes, or general public records requests.
(b) Any recipient of line-level data must comply with department conditions for use, security, retention, and destruction, as set forth in a department data use agreement or equivalent written instrument.
(c) Persons authorized by the director may conduct research studies pursuant to 216 RICR 30-05-1; provided, however, that the researcher shall submit a written request for information, shall execute a research agreement that protects the confidentiality of the information provided and obtain any relative human subjects approval.
(d) The department may enter into collaborative agreements with registries of states and exchange individual or group information provided that maximum protections are afforded the confidentiality of citizens of Rhode Island in accordance with state law.
(e) Immunization information, obtained pursuant to § 23-1-44, shall only be released from the immunization registry to the following individuals and agencies, unless the registrant, or the parent or guardian if the registrant is a minor, objects to such disclosure. All such disclosures shall comply with the privacy protections of chapter 37.3 of title 5 and the Health Insurance Portability and Accountability Act of 1996, Pub. L. No. 104-191 (HIPAA), as amended and all other applicable state and federal laws:
(1) Licensed health care providers providing direct care to the registrant-patient;
(2) Elementary and secondary school nurses and institutions of higher education, and registration officials who require proof of immunization for school enrollment and disease control;
(3) State Women Infants and Children, or WIC, nutrition program staff who administer WIC benefits to eligible infants and children;
(4) Staff of state agencies or state programs whose duties include education and outreach related to the improvement of immunization coverage rates;
(5) Health plans for immunization rate improvement and quality improvement efforts; and
(6) Any other entity with the express written consent of the registrant or the registrant’s parent or guardian if the registrant is a minor.
(f) Notwithstanding the provisions of subsection (e) of this section;
(1) Persons authorized by the director may conduct research studies pursuant to § 23-1- 18(10); provided, however, the researcher shall submit a written request for information, shall execute a research agreement that protects the confidentiality of the information provided, and obtain any relative human subject’s approval.
(2) The department may enter into collaborative agreements with registries of other states and exchange individual or group information provided that maximum protections are afforded the confidentiality of registrant information in accordance with state and federal law.
SECTION 2. This act shall take effect upon passage.
