2026 -- H 7936

========

LC005897

========

     STATE OF RHODE ISLAND

IN GENERAL ASSEMBLY

JANUARY SESSION, A.D. 2026

____________

A N   A C T

RELATING TO HEALTH AND SAFETY -- PUBLIC HEALTH DATA PRIVACY AND

PROTECTION ACT

     Introduced By: Representatives Donovan, Furtado, Ajello, Dawson, Boylan, Roberts,
Potter, Giraldo, Carson, and Speakman

     Date Introduced: February 27, 2026

     Referred To: House Health & Human Services

     (Dept. of Health)

It is enacted by the General Assembly as follows:

     SECTION 1. Title 23 of the General Laws entitled "HEALTH AND SAFETY" is hereby

amended by adding thereto the following chapter:

CHAPTER 106

PUBLIC HEALTH DATA PRIVACY AND PROTECTION ACT

     23-106-1. Definitions.

     For purposes of this chapter:

     (1) “De-identified data” means data from which identifiers have been removed in

accordance with applicable state and federal standards such that the data cannot reasonably be used

to identify an individual.

     (2) “Line-level data” means reportable disease data that includes direct or indirect

identifiers, or that can reasonably be used to identify an individual case, contact, or reporting entity.

Individual-level or line-level data can also be known as record-level data.

     (3) “Public health purpose” means activities necessary to prevent or control disease, injury,

or disability including, but not limited to public health surveillance, investigation, outbreak

response, intervention, and evaluation.

     (4) “Reportable disease data” means any information, record, laboratory result, medical

record, or other data collected or maintained by Rhode Island department of health (“department”)

pursuant to state law or regulation for the purpose of disease reporting, surveillance, investigation,

control, or prevention.

     23-106-2. Confidentiality of reportable disease data.

     (a) All reportable disease data, including line-level data, in the possession or control of the

department shall be confidential and shall not be considered a public record.

     (b) Such data shall not be disclosed, subpoenaed, or otherwise released except as expressly

authorized in § 23-106-3 or as required by federal law.

     (c) The confidentiality protections in this section apply regardless of the format of the data,

including paper records, electronic records, and databases.

     23-106-3. Authority and permitted releases.

     (a) The Rhode Island department of health is the sole authority responsible for determining

access to, confidentiality of, and release of reportable disease data. No other state agency, political

subdivision, or entity shall release reportable disease line-level data without written authorization

by the department.

     (b) The department may release de-identified reportable disease line-level data only when

necessary for a public health purpose, including:

     (1) Sharing with other local, state, tribal, territorial, or federal public health authorities

(including the Centers for Disease Control and Prevention) for surveillance, investigation, or

control activities;

     (2) Sharing with healthcare facilities, laboratories, or providers as needed for case

management, outbreak control, or prevention;

     (3) Sharing with researchers or partners pursuant to a department-approved data use

agreement that limits use to a public health purpose and prohibits re-identification or re-disclosure;

or

     (4) As otherwise required by federal law.

     (c) The department may release de-identified data or aggregate statistical reports when the

department determines such release is in the public interest and does not create a reasonable risk of

re-identification.

     23-106-4. Limitations on disclosure.

     (a) Line-level reportable disease data shall not be released for purposes unrelated to public

health, including litigation, commercial purposes, or general public records requests.

     (b) Any recipient of line-level data must comply with department conditions for use,

security, retention, and destruction, as set forth in a department data use agreement or equivalent

written instrument.

     (c) Persons authorized by the director may conduct research studies pursuant to 216 RICR

LC005897 - Page 2 of 4

30-05-1; provided, however, that the researcher shall submit a written request for information, shall

execute a research agreement that protects the confidentiality of the information provided and

obtain any relative human subjects approval.

     (d) The department may enter into collaborative agreements with registries of states and

exchange individual or group information provided that maximum protections are afforded the

confidentiality of citizens of Rhode Island in accordance with state law.

     (e) Immunization information, obtained pursuant to § 23-1-44, shall only be released from

the immunization registry to the following individuals and agencies, unless the registrant, or the

parent or guardian if the registrant is a minor, objects to such disclosure. All such disclosures shall

comply with the privacy protections of chapter 37.3 of title 5 and the Health Insurance Portability

and Accountability Act of 1996, Pub. L. No. 104-191 (HIPAA), as amended and all other applicable

state and federal laws:

     (1) Licensed health care providers providing direct care to the registrant-patient;

     (2) Elementary and secondary school nurses and institutions of higher education, and

registration officials who require proof of immunization for school enrollment and disease control;

     (3) State Women Infants and Children, or WIC, nutrition program staff who administer

WIC benefits to eligible infants and children;

     (4) Staff of state agencies or state programs whose duties include education and outreach

related to the improvement of immunization coverage rates;

     (5) Health plans for immunization rate improvement and quality improvement efforts; and

     (6) Any other entity with the express written consent of the registrant or the registrant’s

parent or guardian if the registrant is a minor.

     (f) Notwithstanding the provisions of subsection (e) of this section;

     (1) Persons authorized by the director may conduct research studies pursuant to § 23-1-

18(10); provided, however, the researcher shall submit a written request for information, shall

execute a research agreement that protects the confidentiality of the information provided, and

obtain any relative human subject’s approval.

     (2) The department may enter into collaborative agreements with registries of other states

and exchange individual or group information provided that maximum protections are afforded the

confidentiality of registrant information in accordance with state and federal law.

     SECTION 2. This act shall take effect upon passage.

========

LC005897

========

LC005897 - Page 3 of 4

EXPLANATION

BY THE LEGISLATIVE COUNCIL

OF

A N   A C T

RELATING TO HEALTH AND SAFETY -- PUBLIC HEALTH DATA PRIVACY AND

PROTECTION ACT

***

     Thia act would create the public health data privacy and protection act to regulate the

reporting of information relating to reportable disease data in the possession of the department of

health.

     This act would take effect upon passage.

========

LC005897

========

LC005897 - Page 4 of 4