Skip to main content
S 2852Medical Services

Businesses and Professions - Confidentiality of Healthcare Communications and Information Act

This bill allows patients to authorize healthcare providers to send their medical records via email, including unencrypted email.

Held for study
Population
Affected
65
Email Legislator
Introduced Mar 4, 2026Committee Senate Health & Human Services

Plain-English Summary

This legislation amends the "Confidentiality of Healthcare Communications and Information Act" to allow patients to request their medical records in various formats, including unencrypted email. Under this bill, healthcare providers must furnish records in the requested format if it is readily producible. Crucially, providers are permitted to send records via unencrypted email if the patient provides written authorization, acknowledges the security risks involved, and consents to the transmission. The bill requires providers to keep this authorization on file and directs the Department of Health to create regulations and model forms to manage this process.

For younger readers

When you go to the doctor, they write notes about your health. Sometimes, you or your parents might want a copy of those notes. Usually, doctors have to use special secret computer codes to send these notes so no one else can read them. This new rule says that if your parents sign a paper saying they understand it might not be secret, the doctor is allowed to send the notes in a regular email. This makes it easier for people to get their information quickly.

Who & Where It Applies

Impacted groups
PatientsHealthcare ProvidersDepartment of HealthMedical Records StaffHospital Administrators
Impacted communities
All

Constitutional & Fiscal Check

None Likely

Estimated cost
None
Estimated revenue
None

Bill Analysis

Both viewpoints
For Progressives
  • Increases equity in healthcare access by allowing patients without access to sophisticated secure portals or fax machines to receive records via standard email.
  • Empowers patients with greater agency and control over their own personal health data, reducing paternalistic barriers to information.
  • Reduces the administrative burden and potential costs for patients who previously had to pay for paper copies or travel to pick up records.
  • Increases the risk that sensitive health information could be intercepted or leaked, potentially harming vulnerable populations if the data falls into the wrong hands.
  • May encourage healthcare systems to rely on less secure communication methods rather than investing in user-friendly, secure, and free patient portals.
  • Relies on "informed consent" forms that patients with lower literacy levels may sign without fully understanding the permanent privacy risks of unencrypted transmission.
For Conservatives
  • Promotes individual liberty by allowing citizens to assess their own risk tolerance and decide how they wish to receive their own property (medical records).
  • Reduces regulatory fear for private practices by clarifying that they can comply with patient requests for email without facing state penalties for lack of encryption.
  • Increases efficiency in the private healthcare market by removing technical bottlenecks that slow down the transfer of information.
  • Expands the administrative state by empowering the Department of Health to promulgate new rules, regulations, and government-mandated forms.
  • Creates a new record-keeping mandate for businesses, requiring them to retain specific authorizations in medical records, adding to bureaucratic paperwork.
  • Could create confusion and potential liability for businesses if the state law is perceived to conflict with strict federal HIPAA requirements regarding data security.

Votes

Loading votes...

Full Bill Text

Changes to existing Rhode Island law · 20 additions

SECTION 1. Chapter 5-37.3 of the General Laws entitled "Confidentiality of Healthcare Communications and Information Act" is hereby amended by adding thereto the following section: 5-37.3-13. Electronic transmission of medical notes and records.

(a) A healthcare provider shall, upon the written request of a patient or the patient’s authorized representative, furnish medical notes or other medical records in any readily producible form or format consistent with state and federal law.

(b) Permissible formats shall include, but not be limited to, paper copies, facsimile transmission, secure electronic transmission, patient portal access, and electronic mail.

(c) A provider may transmit a medical note or medical record by electronic mail, including unencrypted email, when:

(1) The patient provides a written authorization identifying the specific email address for delivery;

(2) The authorization acknowledges the potential privacy and security risks of email transmission; and

(3) The patient consents to receive the information by email despite such risks.

(d) The provider shall retain the patient’s authorization in the medical record.

(e) A provider shall not be required to transmit records by email if unable to do so in a manner consistent with applicable federal law; provided an alternative lawful method is offered.

(f) Nothing in this section shall be construed to limit rights under HIPAA or to require encryption where a patient has expressly requested unencrypted email and acknowledged the risks.

(g) The department of health shall promulgate rules, regulations, or guidance, including model authorization forms, to implement this section.

SECTION 2. This act shall take effect upon passage.