WeVote
Log In

Bill

Bill

SB 3256

AN ACT RELATING TO HEALTH AND SAFETY -- PUBLIC HEALTH DATA PRIVACY AND PROTECTION ACT

2026 Regular Session Introduced by John Burke and 1 co-sponsor

RIDOH controls access and releases of line-level reportable disease data, prioritizing de-identified information for public health while restricting non-public disclosures.

06/05/2026 Referred to House Health & Human Services
0
WeVote Research Nonpartisan
Bill Summary · SB 3256

Summary of Bill: SB 3256 (2026) – Public Health Data Privacy and Protection Act (Rhode Island)

Purpose and Intent

  • Establishes a comprehensive framework to protect the privacy and confidentiality of Rhode Island’s reportable disease data held by the Department of Health (RIDOH).
  • Aims to ensure data sharing for public health purposes is tightly controlled, de-identified where possible, and restricted to authorized uses and recipients.

Key Provisions and Changes

Definitions (Chapter 106, 23-106-1)

  • De-identified data: Data stripped of identifiers per applicable standards so individuals cannot reasonably be identified.
  • Line-level/data at the record level: Reportable disease data that includes direct or indirect identifiers or could identify an individual case, contact, or reporting entity.
  • Public health purpose: Activities to prevent or control disease, injury, or disability (surveillance, investigation, outbreak response, intervention, evaluation).
  • Reportable disease data: Information collected by RIDOH for disease reporting, surveillance, investigation, control, or prevention.

Confidentiality of Reportable Disease Data (Chapter 106, 23-106-2)

  • All reportable disease data (including line-level data) held by RIDOH is confidential and not a public record.
  • Data cannot be disclosed, subpoenaed, or released except as expressly authorized or required by federal law.
  • Confidentiality applies regardless of format (paper, electronic, databases).

Authority and Permitted Releases (Chapter 106, 23-106-3)

  • RIDOH is the sole authority to determine access, confidentiality, and release of reportable disease data.
  • No other agency or entity may release line-level data without written authorization from RIDOH.
  • De-identified data may be released for public health purposes under restricted circumstances:
    • With other public health authorities (local, state, tribal, federal, including CDC) for surveillance, investigation, or control.
    • To healthcare facilities, laboratories, or providers for case management or outbreak control.
    • To researchers or partners via department-approved data use agreements that limit use to public health purposes and prohibit re-identification.
    • As required by federal law.
  • De-identified data or aggregate reports can be released if in the public interest and does not pose a reasonable re-identification risk.

Limitations on Disclosure (Chapter 106, 23-106-4)

  • Line-level data cannot be released for non-public health purposes (e.g., litigation, commercial use, general public records requests).
  • Recipients must comply with data use, security, retention, and destruction conditions in RIDOH agreements.
  • Researchers may conduct studies with director authorization and must:
    • Submit a written information request.
    • Sign a confidentiality-protective research agreement.
    • Obtain necessary human subjects approvals.
  • RIDOH may enter into collaborative agreements with registries (state-level) with robust confidentiality protections.
  • Immunization information from the immunization registry can only be released to:
    • Licensed healthcare providers caring for the patient.
    • School nurses, school enrollment officials, higher education institutions, and WIC staff or similarly authorized programs.
    • State agencies/programs focused on immunization coverage or quality improvement.
    • Health plans for immunization rate improvement and quality efforts.
    • Other entities with explicit written consent from the registrant (or parent/guardian if a minor).
  • Additional provisions for research and interstate collaborations:
    • Authorized researchers may conduct studies with appropriate approvals and confidentiality protections.
    • RIDOH may engage in collaborative agreements with registries of other states under strong confidentiality protections.

Affected Parties

  • Rhode Island Department of Health (RIDOH): Primary administrator and gatekeeper of all reportable disease data; determines access, confidentiality, and release.
  • Public health stakeholders: Local, state, tribal, territorial, and federal public health authorities; researchers; healthcare facilities, laboratories, and providers involved in case management and outbreak response.
  • Immunization registry participants: Information may be released to specified entities under strict privacy rules.
  • General public and data recipients: Data releases are limited to de-identified or aggregated data for public health purposes; non-public health uses are restricted.

Procedural and Timeline Aspects

  • Effective date: The act takes effect upon passage.
  • Implementation: Places RIDOH as the sole authority for data access and release, with formal data use agreements and written authorizations required for disclosures.
  • Data protection framework: Emphasizes de-identification, minimum necessary disclosure, and robust security/retention/destruction requirements.
  • Research and interstate cooperation: Allows for regulated research and cross-state sharing under strict confidentiality provisions and human subjects protections.

Practical Implications

  • Strengthens privacy protections for individuals’ health data in Rhode Island.
  • Centralizes decision-making about data access within RIDOH.
  • Encourages use of de-identified data for research and interagency public health activities while restricting sensitive, line-level disclosures.
  • Establishes clear conditions and safeguards to reduce re-identification risk and protect sensitive health information.

Compiled from official sources — confirm details with the bill’s official record.

Sign in to ask a question.