Health record rights in Rhode Island: what state law adds
In Rhode Island, as of October 3, 2026, your OK is needed before at least some businesses outside HIPAA share your health data; you get a free copy of your record in some cases; you can opt out of the health information exchange; reproductive health, mental health, HIV and genetic records each have a specific confidentiality rule; you can sue over misuse of your records; breach notices must cover medical and health insurance information; and two of the three rules we look for on AI in care are in force. Each answer below quotes, dates and links the law. There is no state total and no state rank.
Laws read · page updated
Not legal advice. This records what the law said on the date we read it. Laws and court orders change. Read the law itself, or ask a lawyer, before you rely on it. State laws add to the federal floor. The national score rates federal law and national infrastructure and does not change with these state profiles.
Can you sue if your records are misused?Yes. You can sue over unlawful collection, use or sharing of medical records or health data in general. Same answer in 11 of the 50 states, counting this one.
Are there rules for AI used in your care?Two of the three rules are in force. You must be told when AI is used in your care. A licensed clinician decides, not AI alone. Same answer in 6 of the 50 states, counting this one.
Federal law, mainly HIPAA, applies in every state; our US page explains it in plain English. Each answer below says what this state adds on top, with the law's name, citation, effective date, the words that matter and a link to the official page.
Do apps and wearables need your OK before sharing health data?
Federal floor: HIPAA does not cover most apps, wearables, websites or data brokers.
Yes, at least for some businesses. A law in force requires your OK before they use or share your health data (opt-in).
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Comprehensive privacy law in force since 1 January 2026 requires consent to process sensitive data, which includes mental or physical health condition or diagnosis. No dedicated consumer health data law found.
Rhode Island Data Transparency and Privacy Protection Act, Processing of information. R.I. Gen. Laws § 6-48.1-4(c)
In force · effective · read October 3, 2026 · source(webserver.rilegislature.gov)
The controller shall not process sensitive data concerning a customer without obtaining customer consent
Who it binds, in our words: Controlled or processed the personal data of not less than thirty-five thousand (35,000) customers, excluding personal data controlled or processed solely for the purpose of completing a payment transaction.
Rhode Island Data Transparency and Privacy Protection Act, Definitions (sensitive data). R.I. Gen. Laws § 6-48.1-2(26)
In force · effective · read October 3, 2026 · source(webserver.rilegislature.gov)
means personal data that includes data revealing racial or ethnic origin, religious beliefs, mental or physical health condition or diagnosis, sex life,
Who it binds, in our words: Also: Controlled or processed the personal data of not less than ten thousand (10,000) customers and derived more than twenty percent (20%) of their gross revenue from the sale of personal data.
Second check by a separate agent: confirmed.
Do you get a copy faster or free in some cases?
Federal floor: HIPAA gives the provider 30 days, plus one 30-day extension, and allows a cost-based fee. We also count the federal information blocking rule (45 CFR Part 171).
In one way: a free copy in at least one case.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Free copy for Social Security, needs-based benefit, workers' compensation and veterans' claims counts. Deadline is 30 days, not shorter than HIPAA. Per-page caps are recorded as facts only. 23-1-48 date is from P.L. 2017 ch. 120.
Deadline in the law: 30 days (not shorter than HIPAA's 30).
Free copy: Health care facilities: no charge for a record needed to support a Social Security Act appeal, a workers' compensation claim, or a veteran's benefits application (R.I. Gen. Laws § 23-17-19.1(16)).
Free copy: Physicians: no charge for school immunization records or for a claim or appeal under the Social Security Act or a federal or state needs-based program (216-RICR-40-05-1, 1.5.12(B)(3)).
Fee rule: R.I. Gen. Laws § 23-1-48(c)(2): electronic copies, clerical fee up to $25.00, plus $0.50 per page for first 100 pages and $0.25 per page after; page charges capped at $100.
Fee rule: R.I. Gen. Laws § 23-1-48(d): paper records, clerical fee up to $25.00 plus same per-page rates and actual shipping.
Fee rule: R.I. Gen. Laws § 23-1-48(f): $10.00 special handling fee for delivery within 48 hours.
Fee rule: 216-RICR-40-05-1, 1.5.12(B)(1): physician fee for a patient's own copy must be consistent with 45 C.F.R. § 164.524; no retrieval or certifying fee for own records.
Goes beyond the federal floor: yes.
Rights of patients (health care facilities), free record for benefits appeals. R.I. Gen. Laws § 23-17-19.1(16)
In force · effective · read October 3, 2026 · source(webserver.rilegislature.gov)
shall be made for furnishing a health record or part of a health record to a patient, the patient’s attorney, or authorized representative if the record, or part of the record, is necessary for the purpose of supporting an appeal under any provision of the Social Security Act
Who it binds, in our words: Every healthcare facility licensed under this chapter
Licensure and Discipline of Physicians, Medical Records reimbursement. 216-RICR-40-05-1, § 1.5.12(B)(3)
In force · effective · read October 3, 2026 · source(rules.sos.ri.gov)
Charges shall not be made if the record is requested for immunization records required for school admission or by the applicant or beneficiary or individual representing an applicant or beneficiary for the purposes of supporting a claim or appeal under the provision of the Social Security Act
Who it binds, in our words: Physicians licensed in Rhode Island. The same rule sets a 30-day deadline: requested records must be provided within thirty (30) days.
Reimbursement for medical record copies. R.I. Gen. Laws § 23-1-48
In force · effective · read October 3, 2026 · source(webserver.rilegislature.gov)
the charges for responding to requests for copies of medical records in electronic format shall not exceed a fee for clerical services, research, and handling of twenty-five dollars ($25.00), inclusive of shipping costs and the costs of data retrieval
Who it binds, in our words: any healthcare provider as defined in § 5-37.3-3
Second check by a separate agent: confirmed.
Can you say no to sharing through a health information exchange (a network that passes records between doctors)?
Federal floor: HIPAA lets providers share records for treatment without asking you.
Opt-out. Your records go through the exchange unless you say no, and there is a published way to say no.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Statute and rule set opt-out with a published opt-out form. The rule states mental health treatment information is included and subject to the same opt-out. No stricter state consent rule for sensitive data was found in the HIE law.
Set by state law.
Designated exchange: CurrentCare (statewide HIE run by the state-designated RHIO).
Rhode Island Health Information Exchange Act, Disclosure. R.I. Gen. Laws § 5-37.7-7(a)
In force · effective · read October 3, 2026 · source(webserver.rilegislature.gov)
a patient or the patient’s authorized representative may opt out of having the patient’s confidential healthcare information disclosed from the HIE.
Who it binds, in our words: The statewide HIE established under state authority (§ 5-37.7-4)
Regional Health Information Organization and Health Information Exchange rule, opt-out forms. 216-RICR-10-10-6
In force · effective · read October 3, 2026 · source(rules.sos.ri.gov)
Opt-out forms provided by the HIE shall be broadly available and accessible through a variety of methods. At minimum, such methods must include paper forms submitted by fax or mail, and electronic submission by website.
Who it binds, in our words: The RHIO and the HIE
Second check by a separate agent: confirmed.
Are some sensitive records, like mental health or HIV, given extra rules?
These answers record whether a rule exists and what it says. They say nothing about whether any care is legal or available.
Reproductive health records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Subsection (e) lists acts a state business entity may not do, including complying with out-of-state legal process for records about legally protected healthcare activity, which includes reproductive healthcare services.
Healthcare Provider Shield, Testimony, documents, and subpoenas. R.I. Gen. Laws § 23-101-5(e)(2)
In force · effective · read October 3, 2026 · source(webserver.rilegislature.gov)
Comply with an out-of-state subpoena, warrant, court order, or other civil or criminal legal process for records, information, facilities, or assistance that the business entity has reason to believe relates to legally protected healthcare activity
Who it binds, in our words: A business entity that is incorporated, or has its principal place of business, in this state
Healthcare Provider Shield, Definitions. R.I. Gen. Laws § 23-101-2(8)
In force · effective · read October 3, 2026 · source(webserver.rilegislature.gov)
The exercise and enjoyment or attempted exercise and enjoyment by any person of the right secured by this state to gender-affirming healthcare services or reproductive healthcare services
Second check by a separate agent: confirmed.
Mental health records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Records may be disclosed only in listed cases, the first being written consent of the patient or guardian (§ 40.1-5-26(b)(1)).
Disclosure of confidential information and records (mental health services). R.I. Gen. Laws § 40.1-5-26(a)
In force · effective · read October 3, 2026 · source(webserver.rilegislature.gov)
The fact of admission or certification, and all information and records compiled, obtained, or maintained in the course of providing services to persons under this chapter, shall be confidential.
Who it binds, in our words: Services to persons under chapter 40.1-5 (Mental Health Law)
Second check by a separate agent: confirmed.
HIV records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Current text from P.L. 2009 ch. 196, which states it takes effect July 1, 2009.
HIV testing, Confidentiality. R.I. Gen. Laws § 23-6.3-7(a)
In force · effective · read October 3, 2026 · source(webserver.rilegislature.gov)
It is unlawful for any person to disclose to a third-party the results of an individual’s HIV test without the prior written consent of that individual
Who it binds, in our words: any person
Second check by a separate agent: confirmed.
Genetic records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
27-41-53 last amended by P.L. 2001 ch. 38, effective on passage, enacted 27 June 2001. 27-18-52 last amended by P.L. 2002 ch. 292, effective on passage; 27-18-52: 2002-06-28; 27-41-53: 2001-07-02.
Health maintenance organizations, Genetic testing. R.I. Gen. Laws § 27-41-53(a)
In force · effective · read October 3, 2026 · source(webserver.rilegislature.gov)
insurance administrators, health plans, and providers shall be prohibited from releasing genetic information without prior written authorization of the individual.
Who it binds, in our words: insurance administrators, health plans, and providers
Accident and sickness insurance, Genetic testing. R.I. Gen. Laws § 27-18-52(a)
In force · effective · read October 3, 2026 · source(webserver.rilegislature.gov)
insurance administrators, health plans, and providers shall be prohibited from releasing genetic information without prior written authorization of the individual.
Who it binds, in our words: insurance administrators, health plans, and providers
Second check by a separate agent: disputed, then settled by the authors on October 3, 2026.
Can you sue if your records are misused?
Yes. You can sue over unlawful collection, use or sharing of medical records or health data in general.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
5-37.3-9 history ends with P.L. 1982 ch. 356. That act is not online, so its day of effect was not confirmed and effectiveDate is null. Its in-force status is shown on the current code page.
Damages a court may award: None fixed. Actual and exemplary damages; attorney's fees at the court's discretion (§ 5-37.3-9). The privacy act bars a private action (§ 6-48.1-8(c)).
Confidentiality of Health Care Communications and Information Act, Penalties. R.I. Gen. Laws § 5-37.3-9(a)
In force · current version date not confirmed · read October 3, 2026 · source(webserver.rilegislature.gov)
Anyone who violates the provisions of this chapter may be held liable for actual and exemplary damages.
Who it binds, in our words: Anyone who violates chapter 5-37.3 (confidential healthcare information)
Health Information Exchange Act, Penalties. R.I. Gen. Laws § 5-37.7-13(a)
In force · effective · read October 3, 2026 · source(webserver.rilegislature.gov)
Anyone who violates the provisions of this chapter may be held liable for actual and exemplary damages.
Who it binds, in our words: Anyone who violates chapter 5-37.7 (HIE)
Rhode Island Data Transparency and Privacy Protection Act, Violations. R.I. Gen. Laws § 6-48.1-8(c)
In force · effective · read October 3, 2026 · source(webserver.rilegislature.gov)
Nothing in this section shall be construed to authorize any private right of action to enforce any provision of this chapter
Second check by a separate agent: disputed, then settled by the authors on October 3, 2026.
Must you be told if health data leaks in a breach?
Yes. The breach notice law covers both medical information and health insurance information.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Personal information includes medical and health insurance information. Notice within 45 days. AG notice when over 500 residents. HIPAA entities deemed compliant. 11-49.3-6 date: P.L. 2015 ch. 138, effective one year after passage.
Deadline to tell people: No later than 45 calendar days after confirmation of the breach.
The attorney general or a regulator must also be told.
A business that follows HIPAA's breach rules is treated as following this law.
In force · effective · read October 3, 2026 · source(webserver.rilegislature.gov)
Medical or health insurance information; or
Identity Theft Protection Act, Notification of breach. R.I. Gen. Laws § 11-49.3-4(a)
In force · effective · read October 3, 2026 · source(webserver.rilegislature.gov)
In the event that more than five hundred (500) Rhode Island residents are to be notified, the person shall notify the attorney general and the major credit reporting agencies
Who it binds, in our words: Municipal agencies, state agencies and persons that store, own, collect, process, maintain, acquire, use, or license data with personal information
Identity Theft Protection Act, Agencies or persons with security breach procedures. R.I. Gen. Laws § 11-49.3-6(c)
In force · effective · read October 3, 2026 · source(webserver.rilegislature.gov)
Act of 1996 (HIPAA) shall be deemed in compliance with this chapter.
Who it binds, in our words: A provider of health care, healthcare service plan, health insurer, or a covered entity governed by the HIPAA rules
Second check by a separate agent: confirmed.
Are there rules for AI used in your care?
The three rules we look for: you must be told when AI is used in your care; a licensed clinician decides, not AI alone; you can reach a human, or have a human review the decision. Each counts only if the law names health care or health coverage.
Two of the three rules are in force. You must be told when AI is used in your care. A licensed clinician decides, not AI alone.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Level rests on the mental health AI act, effective on passage (enacted 22 June 2026). Both acts are not yet in the online code. No in-force insurer AI law or human review right was found.
"Level" is the step on our rulebook's scale for this question. 0 means nothing beyond HIPAA. Higher means the law gives you more here.
You must be told when AI is used in your care: in force.
A licensed clinician decides, not AI alone: in force.
You can reach a human, or have a human review the decision: not found.
Related limit on AI (recorded, not counted in the answer): P.L. 2026 ch. 374, § 40.1-5.5-3(c): a licensed professional may not use AI to "Make independent therapeutic decisions;"
Related limit on AI (recorded, not counted in the answer): P.L. 2026 ch. 374, § 40.1-5.5-3(c)(3): "Determine therapeutic recommendations or treatment plans."
Related limit on AI (recorded, not counted in the answer): P.L. 2026 ch. 374, § 40.1-5.5-3(b): "An individual, corporation, or entity may not provide, advertise, or otherwise offer therapy or psychotherapy services" unless conducted by a licensed professional.
Oversight of Artificial Intelligence Technology in Mental Health Care Act, use restrictions (disclosure and consent). P.L. 2026, ch. 374 (2026-S 2197 Sub A as amended), adding R.I. Gen. Laws § 40.1-5.5-3(a)
In force · effective · read October 3, 2026 · source(webserver.rilegislature.gov)
unless the patient or the patient's parent, guardian or other legally authorized representative is informed in writing of the following and provides consent as defined in § 40.1-5.5-2: (1) That artificial intelligence will be used;
Who it binds, in our words: Licensed professionals or providers of therapy or psychotherapy services, where the client's session is recorded or transcribed
Oversight of Artificial Intelligence Technology in Mental Health Care Act, use restrictions (clinician decides). P.L. 2026, ch. 374, adding R.I. Gen. Laws § 40.1-5.5-3(c)
In force · effective · read October 3, 2026 · source(webserver.rilegislature.gov)
A licensed professional or provider may not allow or otherwise use artificial intelligence to do any of the following: (1) Make independent therapeutic decisions;
Who it binds, in our words: Licensed professionals or providers of therapy or psychotherapy services
Use of Artificial Intelligence by Healthcare Providers Notification Act. P.L. 2026, ch. 372 (2026-S 2570 Sub A), adding R.I. Gen. Laws chapter 23-108
In force · effective · read October 3, 2026 · source(webserver.rilegislature.gov)
shall notify patients of the use of AI for that sole purpose and review the AI-generated documentation for accuracy after the visit.
Who it binds, in our words: Any and all healthcare providers and healthcare facilities that employ artificial intelligence ("AI") to document in-person or telehealth visits
Second check by a separate agent: confirmed.
Rights in practice: the setting
These public figures describe conditions that can affect whether people are able to use the rights above, such as health insurance and internet at home. They are not scored, not part of any answer, and not a reason for any answer. Each is the latest the source publishes for the state, checked against the publisher (the Census Bureau or the Bureau of Labor Statistics); grouped under the Healthy People 2030 social determinants of health.
Source and period on every row. Figures from DataSpine, each checked against its publisher. Not scored.
Figure
Value
Source and period
People under 65 without health insuranceHealth care access and quality
5.3%
Small Area Health Insurance Estimates, SAHIE 2024 (single-year model estimate)
Households with a computerHealth care access and quality
92.9%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households with a broadband internet subscriptionHealth care access and quality
89.2%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households with a smartphone and no other computerHealth care access and quality
8.2%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Median household incomeEconomic stability
$81,370 (2022 dollars)
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Unemployment rateEconomic stability
4.4%
Local Area Unemployment Statistics, December 2025, monthly, seasonally adjusted
Households without a vehicleNeighborhood and built environment
9.0%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
People who speak a language other than English at homeSocial and community context
22.4%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households of one person aged 65 or overSocial and community context
13.2%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Not shown: the number of people below the poverty line and the number with a bachelor's degree, which are available only as counts, and counts do not compare across states of different size.
Not shown yet, with no checked state figure: Medicare members who also have Medicaid; Medicaid enrollment; primary care supply; social vulnerability, income and jobs; people in nonmetro counties; social vulnerability, housing and transport; social vulnerability, household and minority themes.
Also recorded: a data broker registry
A fact, not part of any answer above. No law found We found no data broker registry law.
Another state
This study covers the 50 states and Washington, DC. It does not cover the US territories (Puerto Rico, Guam, the US Virgin Islands, the Northern Mariana Islands and American Samoa).
Built by SuperTruth, which checks whether a record can be trusted before an AI acts on it. About SuperTruth · How we used AI
Health Record Rights Index by SuperTruth. Research by AI agents built on Anthropic's Claude, checked by a second agent and ruled by the authors; how we did it. Research tool, not legal advice. Text CC BY 4.0.
