A Guide to Rhode Island Privacy Laws for Endoscopy Reporting Software Vendors

What patient information does Rhode Island’s health care confidentiality law protect?

Rhode Island’s Confidentiality of Health Care Communications and Information Act protects “confidential healthcare information”: information relating to a patient’s healthcare history, diagnosis, condition, treatment, or evaluation that a treating healthcare provider obtains. It also protects confidential healthcare communications, including information a patient communicates to a provider that is not intended for disclosure to others, subject to limited exceptions. An endoscopy report can therefore contain protected information in its findings, diagnosis, treatment details, and patient history. R.I. Gen. Laws § 5-37.3-3

The statute’s definition of healthcare provider includes licensed providers and, in specified circumstances, their officers, employees, and agents. It also sets security requirements for third parties that receive and retain confidential healthcare information. A software vendor’s duties depend on its role and the information it handles; the fact that a vendor supplies software does not by itself determine whether it is a HIPAA business associate or how Rhode Island’s confidentiality provisions apply. R.I. Gen. Laws § 5-37.3-3 R.I. Gen. Laws § 5-37.3-4(c)

When may patient health information be disclosed without written consent?

As a general rule, patient confidential healthcare information may not be released or transferred without the patient’s written consent—or consent from an authorized representative—unless a statutory exception or other law permits the disclosure. A consent form must explain the need for and proposed uses of the information, identify what information will be released, and address revocation. If a proposed new use or recipient is outside the consent, additional written consent is generally required unless a law specifically allows the disclosure. R.I. Gen. Laws § 5-37.3-4(a), (d)–(e)

Rhode Island lists exceptions that include disclosures for emergency diagnosis or treatment; medical or dental peer review; qualifying research, audits, and evaluations that protect patient identity; care coordination within a healthcare system; insurance claims and benefit administration; and public-health authority functions. Other exceptions address specified reports to law enforcement or protective agencies, medical-examiner matters, workers’ compensation, certain provider legal representation, school health information, and other purposes named in the statute. Each exception has its own conditions, and some disclosures must be limited to the minimum information necessary. R.I. Gen. Laws § 5-37.3-4(b)

Do not assume that every disclosure allowed by HIPAA is automatically allowed under Rhode Island law. Before configuring a reporting platform to transmit information without written patient consent, identify the specific legal basis, confirm that its conditions are met, and limit the information to the authorized purpose.

Does the Rhode Island Data Transparency and Privacy Protection Act apply to software vendors?

The Rhode Island Data Transparency and Privacy Protection Act took effect on January 1, 2026. It expressly excludes HIPAA covered entities and business associates, and separately exempts HIPAA protected health information and several other categories of health, research, and public-health data. The Act’s exemption for “HIPAA-authorized public health information” covers information used for public-health activities and purposes authorized by HIPAA, as well as community- and population-health activities. Those exemptions do not themselves authorize a disclosure that another law restricts. R.I. Gen. Laws § 6-48.1-3(d)–(e)

A software vendor is not automatically exempt merely because it serves endoscopy practices. HHS explains that a software vendor generally becomes a business associate when it needs access to patient information to provide its service—for example, by hosting software containing patient information or accessing it for troubleshooting. A vendor that only supplies software without access to the provider’s protected health information may not have that business-associate relationship. HHS guidance on software vendors and business associates

For the Act’s main processing, customer-rights, and processor-contract provisions, the data processing thresholds apply to for-profit entities doing business in Rhode Island or targeting Rhode Island residents. During the preceding calendar year, an entity must have controlled or processed the personal data of at least 35,000 customers, excluding data processed solely to complete a payment transaction, or at least 10,000 customers while deriving more than 20% of gross revenue from the sale of personal data. The sale-of-personal-data revenue threshold is not the only test: the 35,000-customer threshold is an alternative. The Act also contains separate rules for certain commercial websites and internet service providers, so vendors should assess those provisions independently rather than treating the thresholds as a blanket exemption from every part of the chapter. R.I. Gen. Laws § 6-48.1-3 R.I. Gen. Laws § 6-48.1-4(a) R.I. Gen. Laws § 6-48.1-7(a)

How does the state privacy act treat health conditions and diagnosis data?

The Act defines sensitive data to include personal data revealing a person’s mental or physical health condition or diagnosis. When the Act applies and no exemption covers the data or entity, a controller may not process sensitive data concerning a customer without obtaining that customer’s consent. A controller must provide a way to grant and revoke consent when consent is required and, after revocation, suspend processing as soon as practicable and within 15 days. R.I. Gen. Laws § 6-48.1-2 and § 6-48.1-4(c), (e)

For endoscopy reporting vendors, the key distinction is whether the relevant data are HIPAA-protected and whether the vendor is a covered entity or business associate. Those categories are expressly excluded or exempted under the Act. Non-exempt data—such as other identifiable customer information handled outside those roles—may still be covered if the entity and processing meet the law’s applicability requirements. Do not treat the sensitive-data consent rule as permission to use or disclose patient health information beyond the purposes allowed by HIPAA, Rhode Island law, or the applicable agreement.

What privacy compliance steps should endoscopy reporting vendors take?

Start by documenting what patient and customer data the software collects, stores, uses, transmits, and deletes. Map each data flow to its purpose, recipient, legal basis, retention period, and system. Identify whether the vendor is acting for a healthcare provider, whether it has access to protected health information, and whether separate non-HIPAA personal data may bring it within the Rhode Island Act.

Where a vendor creates, receives, maintains, or transmits electronic protected health information on behalf of a covered entity, HHS says it generally must have a business associate agreement and comply with applicable HIPAA requirements. The agreement should describe permitted uses and disclosures and safeguard responsibilities. HHS also identifies risk analysis and risk management, appropriate access controls, audit controls, authentication, and transmission security as key parts of the Security Rule framework. HHS guidance on HIPAA and cloud computing HHS summary of the HIPAA Security Rule

Rhode Island separately requires third parties that receive and retain confidential healthcare information to establish safeguards. The statute calls for limiting personally identifiable information access to people with a need to know, assigning responsibility for security procedures, and giving employees or agents a written confidentiality statement that they acknowledge and sign. It also prohibits discipline solely for reporting evidence of a violation. R.I. Gen. Laws § 5-37.3-4(c)

If the Rhode Island Data Transparency and Privacy Protection Act applies to the vendor’s non-exempt processing, establish processes for the Act’s consent, security, and controller-processor obligations. A processor contract must set out processing instructions, purpose, data type, duration, and the parties’ rights and obligations, and address confidentiality, return or deletion, compliance information, subcontractors, and assessments. Controllers also must document assessments for covered heightened-risk activities, including sensitive-data processing, targeted advertising, certain profiling, and sale of personal data. R.I. Gen. Laws § 6-48.1-4 R.I. Gen. Laws § 6-48.1-7

What penalties may apply to violations of Rhode Island health-information confidentiality laws?

Under the Confidentiality of Health Care Communications and Information Act, a person who violates the chapter may face civil liability. Section 5-37.3-4 specifies actual and punitive damages for violations of that section, and allows a court to award reasonable attorney’s fees to the prevailing party. For a knowing and intentional violation of § 5-37.3-4, the section states a maximum fine of $5,000 for each violation, imprisonment for up to six months for each violation, or both. R.I. Gen. Laws § 5-37.3-4(a)(2)–(4)

Section 5-37.3-9 separately describes actual and exemplary damages and, for an intentional and knowing violation of the chapter, a fine of up to $1,000, imprisonment for up to six months, or both; it also allows the court to award attorney’s fees. Because the published statute contains different fine amounts in §§ 5-37.3-4 and 5-37.3-9, vendors should obtain legal advice on which provision applies to a particular alleged violation rather than assuming the penalties are cumulative or interchangeable. R.I. Gen. Laws § 5-37.3-9

For a violation of the Data Transparency and Privacy Protection Act, the Rhode Island Attorney General has sole enforcement authority, and the Act does not create a private right of action. An intentional disclosure of personal data in violation of the Act—or to an entity formed to circumvent it—carries a statutory fine of $100 to $500 for each disclosure. The Act also classifies violations as deceptive trade practices; Rhode Island’s general deceptive-trade-practices law authorizes a civil penalty of up to $10,000 per violation. R.I. Gen. Laws § 6-48.1-8 R.I. Gen. Laws § 6-13.1-8

In short, vendors should identify which law and role apply to each data flow, obtain written consent where required, honor the specific limits on exceptions, and maintain appropriate contractual and security controls. The Rhode Island privacy act’s exemptions and thresholds do not remove a vendor’s separate confidentiality or HIPAA obligations.

FAQs

Does Rhode Island law generally require written consent to release patient health information?

Yes. Rhode Island generally requires written consent from the patient or an authorized representative before confidential healthcare information is released or transferred, unless a statutory exception or other law permits the disclosure. R.I. Gen. Laws § 5-37.3-4(a)

What exceptions permit disclosure without written consent?

Exceptions include certain emergency-care disclosures, peer review, qualifying research and audits, care coordination, insurance and benefit administration, specified law-enforcement or abuse reports, public-health functions, workers’ compensation, and other purposes expressly listed in the statute. The applicable exception’s conditions and limits still control. R.I. Gen. Laws § 5-37.3-4(b)

When does the Rhode Island Data Transparency and Privacy Protection Act take effect?

The Act took effect on January 1, 2026. R.I. Gen. Laws ch. 6-48.1

What penalties may apply for violating Rhode Island’s health-information confidentiality law?

Depending on the provision and facts, penalties may include civil damages, attorney’s fees, and criminal fines or imprisonment. Section 5-37.3-4 states a fine of up to $5,000 per violation and imprisonment of up to six months for a knowing and intentional violation of that section; § 5-37.3-9 separately states a fine of up to $1,000 and imprisonment of up to six months for an intentional and knowing violation of the chapter. R.I. Gen. Laws § 5-37.3-4 R.I. Gen. Laws § 5-37.3-9