Rhode Island Healthcare Compliance Requirements

Rhode Island medical practices operate under the Identity Theft Protection Act of 2015, codified at R.I. Gen. Laws §11-49.3, which requires breach notification within 30 calendar days of confirmation of the breach. The Rhode Island Attorney General must be notified whenever 500 or more Rhode Island residents are affected. Penalties run up to $100 per individual with a $25,000 cap per breach — modest by interstate comparison but enough to matter for a small practice. Medical records carry a 5-year retention floor from discharge under R.I. Gen. Laws §5-37.3-4, with pediatric records running until age 23 or 5 years past last treatment, whichever is later. The HIPAA 6-year floor remains the operative minimum for most practices. The Rhode Island PMP (RI PMP) requires every prescriber to query before every controlled-substance prescription, with exemptions for hospice, cancer, ER 3-day supplies, and inpatient/nursing facility administration. Child-abuse and elder-abuse reporting both run on a 24-hour clock to DCYF and the Department of Elderly Affairs respectively.

Rhode Island's enforcement posture is best described as reactive. The Attorney General's office investigates breaches it learns about — primarily through the §11-49.3 notification process and through consumer complaints — but does not maintain the large healthcare-focused enforcement bench that New York or Massachusetts do. That said, the 30-day notification clock and the explicit 500-resident AG-notification threshold are bright lines that make procedural violations easy to spot. Department of Health licensure surveys provide a parallel pressure point on the retention rule under §5-37.3. Practices that meet the 30-day clock, document a harm analysis, and notify the AG promptly above the 500-resident threshold are largely insulated from state-level enforcement risk; the larger exposure is usually federal (HHS OCR) rather than state.

Guides & Articles