What a provider can and can't say in Rhode Island
The national baseline below is the research's illustrative example, not a template that has been cleared for your practice. The state bullets and the practice-type rows are the rules this research recorded for this jurisdiction.
Illustrative only, not guaranteed legally safe; have a qualified lawyer review any template before use: "Thank you for your feedback. We take every concern seriously, but privacy rules prevent us from discussing anyone's care online. Please call our office manager at [phone] so we can talk directly." Do not confirm that the reviewer is a patient and do not mention treatment details. [F-007, F-024]
HIPAA is not a tool for removing criticism. It limits what covered practices may disclose; it does not restrict what patients may say about their own care. A practice cannot use HIPAA to force a review down. [F-007, F-003]
Review-response rule by practice type
| Practice category | HIPAA status | Applies without HIPAA? | Review-response rule source |
|---|---|---|---|
| Cosmetic/plastic surgery | Depends: covered only if it conducts HIPAA standard electronic transactions (incl. via billing agent); many cash-only cosmetic surgeons are not | Yes - applies to licensed providers regardless of HIPAA status | 5-37.3-4 written-consent rule; 5-37-5.1 grounds (no explicit confidentiality item); no review-reply order located |
| Cosmetic dentistry | Usually yes if it files any electronic dental claims; cash-only dental is not | Yes - applies to licensed providers regardless of HIPAA status | 5-37.3-4 written-consent rule; 5-37-5.1 grounds (no explicit confidentiality item); no review-reply order located |
| General medical/dermatology (elective cosmetic) | Usually yes (insurance billing); covered status applies to all PHI incl. cash cosmetic patients | Yes - applies to licensed providers regardless of HIPAA status | 5-37.3-4 written-consent rule; 5-37-5.1 grounds (no explicit confidentiality item); no review-reply order located |
| Medical med spa | Depends; cash-only med spas often not covered | Yes - applies to licensed providers regardless of HIPAA status | 5-37.3-4 written-consent rule; 5-37-5.1 grounds (no explicit confidentiality item); no review-reply order located |
| Nonmedical aesthetic business | Generally no (not a health care provider billing electronically) | No (unless 'lawfully providing health care') | 5-37.3-4 written-consent rule; 5-37-5.1 grounds (no explicit confidentiality item); no review-reply order located |
- Consumer privacy and health data law: Rhode Island has a consumer privacy law in force (RIDTPPA eff. 2026-01-01). It exempts HIPAA-covered practices as a whole (an entity-level exemption). [RI-002]
- Data breach notification: Its data breach notification law covers medical information. Regulator notice: attorney general if more than 500 residents affected; HIPAA providers deemed compliant. [RI-005]
- Patient confidentiality duties: Patient confidentiality duties come mainly from a medical-confidentiality statute (5-37.3). [RI-003]
- Patient confidentiality duties: The state confidentiality law applies to licensed providers (written consent). [RI-003]
- Lawsuits by individuals: Patients may be able to sue in some situations (5-37.3-9; 9-1-28). [RI-004, RI-008]
- Photos, names and likeness: A statute limits using a person's name or likeness in advertising without consent (9-1-28). [RI-005, RI-008]
- Med spa rules: Med spas: there is med-spa-specific law (2025 Act). [RI-006]
- Enforcement located: Strongest state enforcement evidence located: related official enforcement, or official charges that are allegations only (E2) (Board of Medical Licensure and Discipline, Simpson, 2022). Not finding enforcement does not mean none exists. [RI-007]
Sources:
- [RI-002] R.I. Gen. Laws 6-48.1-8 (https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/6-48.1-8.htm)
- [RI-003] R.I. Gen. Laws 5-37.3-3, 5-37.3-4(a)(1)-(3) (https://webserver.rilegislature.gov/Statutes/TITLE5/5-37.3/INDEX.htm)
- [RI-004] R.I. Gen. Laws 5-37.3-9 (https://webserver.rilegislature.gov/Statutes/TITLE5/5-37.3/5-37.3-9.htm)
- [RI-005] R.I. Gen. Laws 11-49.3-3, 11-49.3-4, 11-49.3-5, 11-49.3-6(c) (https://webserver.rilegislature.gov/Statutes/TITLE11/11-49.3/11-49.3-6.htm)
- [RI-006] P.L. 2025 ch. 309; R.I. Gen. Laws 23-105-3 et seq. (https://webserver.rilegislature.gov/PublicLaws/law25/law25309.htm)
- [RI-007] In re Mary Christina Simpson, M.D., Case Nos. C210784, C210788 (https://datahealth.ri.gov/discipline/MDMarySimpson.pdf)
- [RI-008] R.I. Gen. Laws 9-1-28(a) (https://webserver.rilegislature.gov/Statutes/TITLE9/9-1/9-1-28.htm)
*Educational information, not legal advice. Last reviewed October 22, 2026.*
State comparison
All 5 rows from the research matrix are in this table. Filters and sorting run in the browser after the page loads. Statutory maximums are ceilings, not typical outcomes.
| Rhode Island (RI) | Cosmetic/plastic surgery | Depends: covered only if it conducts HIPAA standard electronic transactions (incl. via billing agent); many cash-only cosmetic surgeons are not | R.I. Gen. Laws 5-37.3 Confidentiality of Health Care Communications and Information Act (written consent; actual and exemplary damages) | Yes - applies to licensed providers regardless of HIPAA status | RIDTPPA (6-48.1), eff. 2026-01-01: ENTITY-level CE/BA exemption; 35k / 10k+20% | 11-49.3: medical info COVERED; 45 days; AG >500; HIPAA providers/CEs deemed compliant | 5-37.3-4 written-consent rule; 5-37-5.1 grounds (no explicit confidentiality item); no review-reply order located | HIPAA if covered; 5-37.3; 9-1-28 written consent for commercial use | R.I. Gen. Laws 9-1-28 (written consent; treble damages for knowing use) | Yes: 5-37.3-9 actual and exemplary damages; 9-1-28 likeness action | RIDOH Board of Medical Licensure and Discipline, Board of Dentistry, Board of Nurse Registration, AG | 5-37.3-9 criminal fine up to $1,000; RIDTPPA $100-$500/disclosure; breach $100-$200/record | E2 (BMLD Simpson 2022, EHR snooping); med spa statute 2025 | High | 2026-10-22 |
| Rhode Island (RI) | Cosmetic dentistry | Usually yes if it files any electronic dental claims; cash-only dental is not | R.I. Gen. Laws 5-37.3 Confidentiality of Health Care Communications and Information Act (written consent; actual and exemplary damages) | Yes - applies to licensed providers regardless of HIPAA status | RIDTPPA (6-48.1), eff. 2026-01-01: ENTITY-level CE/BA exemption; 35k / 10k+20% | 11-49.3: medical info COVERED; 45 days; AG >500; HIPAA providers/CEs deemed compliant | 5-37.3-4 written-consent rule; 5-37-5.1 grounds (no explicit confidentiality item); no review-reply order located | HIPAA if covered; 5-37.3; 9-1-28 written consent for commercial use | R.I. Gen. Laws 9-1-28 (written consent; treble damages for knowing use) | Yes: 5-37.3-9 actual and exemplary damages; 9-1-28 likeness action | RIDOH Board of Medical Licensure and Discipline, Board of Dentistry, Board of Nurse Registration, AG | 5-37.3-9 criminal fine up to $1,000; RIDTPPA $100-$500/disclosure; breach $100-$200/record | E2 (BMLD Simpson 2022, EHR snooping); med spa statute 2025 | High | 2026-10-22 |
| Rhode Island (RI) | General medical/dermatology (elective cosmetic) | Usually yes (insurance billing); covered status applies to all PHI incl. cash cosmetic patients | R.I. Gen. Laws 5-37.3 Confidentiality of Health Care Communications and Information Act (written consent; actual and exemplary damages) | Yes - applies to licensed providers regardless of HIPAA status | RIDTPPA (6-48.1), eff. 2026-01-01: ENTITY-level CE/BA exemption; 35k / 10k+20% | 11-49.3: medical info COVERED; 45 days; AG >500; HIPAA providers/CEs deemed compliant | 5-37.3-4 written-consent rule; 5-37-5.1 grounds (no explicit confidentiality item); no review-reply order located | HIPAA if covered; 5-37.3; 9-1-28 written consent for commercial use | R.I. Gen. Laws 9-1-28 (written consent; treble damages for knowing use) | Yes: 5-37.3-9 actual and exemplary damages; 9-1-28 likeness action | RIDOH Board of Medical Licensure and Discipline, Board of Dentistry, Board of Nurse Registration, AG | 5-37.3-9 criminal fine up to $1,000; RIDTPPA $100-$500/disclosure; breach $100-$200/record | E2 (BMLD Simpson 2022, EHR snooping); med spa statute 2025 | High | 2026-10-22 |
| Rhode Island (RI) | Medical med spa | Depends; cash-only med spas often not covered | R.I. Gen. Laws 5-37.3 Confidentiality of Health Care Communications and Information Act (written consent; actual and exemplary damages) | Yes - applies to licensed providers regardless of HIPAA status | RIDTPPA (6-48.1), eff. 2026-01-01: ENTITY-level CE/BA exemption; 35k / 10k+20% | 11-49.3: medical info COVERED; 45 days; AG >500; HIPAA providers/CEs deemed compliant | 5-37.3-4 written-consent rule; 5-37-5.1 grounds (no explicit confidentiality item); no review-reply order located | HIPAA if covered; 5-37.3; 9-1-28 written consent for commercial use | R.I. Gen. Laws 9-1-28 (written consent; treble damages for knowing use) | Yes: 5-37.3-9 actual and exemplary damages; 9-1-28 likeness action | RIDOH Board of Medical Licensure and Discipline, Board of Dentistry, Board of Nurse Registration, AG | 5-37.3-9 criminal fine up to $1,000; RIDTPPA $100-$500/disclosure; breach $100-$200/record | E2 (BMLD Simpson 2022, EHR snooping); med spa statute 2025 | High | 2026-10-22 |
| Rhode Island (RI) | Nonmedical aesthetic business | Generally no (not a health care provider billing electronically) | R.I. Gen. Laws 5-37.3 Confidentiality of Health Care Communications and Information Act (written consent; actual and exemplary damages) | No (unless 'lawfully providing health care') | RIDTPPA (6-48.1), eff. 2026-01-01: ENTITY-level CE/BA exemption; 35k / 10k+20% | 11-49.3: medical info COVERED; 45 days; AG >500; HIPAA providers/CEs deemed compliant | 5-37.3-4 written-consent rule; 5-37-5.1 grounds (no explicit confidentiality item); no review-reply order located | HIPAA if covered; 5-37.3; 9-1-28 written consent for commercial use | R.I. Gen. Laws 9-1-28 (written consent; treble damages for knowing use) | Yes: 5-37.3-9 actual and exemplary damages; 9-1-28 likeness action | RIDOH Board of Medical Licensure and Discipline, Board of Dentistry, Board of Nurse Registration, AG | 5-37.3-9 criminal fine up to $1,000; RIDTPPA $100-$500/disclosure; breach $100-$200/record | E2 (BMLD Simpson 2022, EHR snooping); med spa statute 2025 | High | 2026-10-22 |
Cases this research tied to this jurisdiction
Settlements and consent orders resolve allegations. They are not court findings that the law was broken. Dollar amounts are the amounts recorded for that matter, not a prediction.
Washburn v. Rite Aid Corp.
Rhode Island Supreme Court · RI · 1997
- Provider type
- Pharmacy
- Relevant facts
- Pharmacy mailed a customer's prescription records to her estranged husband's attorney after receiving a subpoena that called for production in court
- Legal issues
- R.I. Gen. Laws 5-37.3 (Confidentiality of Health Care Communications and Information Act)
- Holding, findings, allegations or settlement terms
- Judicial holding (per Justia and search summaries, secondary): absent notice, consent or court order, mailing the records violated the Act; summary judgment reversed and remanded
- Consequences recorded
- Not determined here
- Procedural status
- Final (precedent)
- Precedential?
- Yes (state high court)
- Why it is in this research
- Shows strict reading of 5-37.3 consent requirement
Rhode Island BMLD: Mary Christina Simpson, M.D.
Rhode Island Board of Medical Licensure and Discipline · RI (state licensing) · 2022 (PDF dated 2022-03-09)
- Provider type
- Physician (OB/GYN, also Botox)
- Relevant facts
- Intentionally viewed a non-patient's EHR without authorization; deficient records for Botox treatments
- Legal issues
- R.I. Gen. Laws 5-37-5.1(21), (24); 216-RICR-40-05-1 sec. 1.5.12 D (records)
- Holding, findings, allegations or settlement terms
- Consent order findings (admission)
- Consequences recorded
- Reprimand; CPEP PROBE ethics course; $2,200 administrative fee (hospital separately suspended privileges 30 days)
- Procedural status
- Final
- Precedential?
- No
- Why it is in this research
- Board discipline for EHR snooping and cosmetic-injectable records (E2)
Related pages
Topics
Healthcare industry
Sources
RI-002. R.I. Gen. Laws 6-48.1-8
RIDTPPA enforcement: AG sole enforcement; violation is a deceptive trade practice under ch. 6-13.1; intentional disclosure of personal data in violation of the chapter carries $100-$500 per disclosure; no private right of action; no cure period stated.
Statute · Explicit · High · Maximum, not typical.
https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/6-48.1-8.htm
RI-005. R.I. Gen. Laws 11-49.3-3, 11-49.3-4, 11-49.3-5, 11-49.3-6(c)
Breach law: personal information includes medical or health insurance information; notice no later than 45 days after confirming a breach that poses a significant risk of identity theft; AG and credit bureaus if more than 500 residents; penalties $100 per record (reckless) and $200 per record (knowing and willful). A health care provider or covered entity governed by the HIPAA privacy and security rules is deemed in compliance with the chapter.
Statute · Explicit · High · Medical information IS covered, but HIPAA entities are deemed compliant; whether a non-HIPAA 'provider of health care' also gets the safe harbor is a drafting ambiguity (U-86).
https://webserver.rilegislature.gov/Statutes/TITLE11/11-49.3/11-49.3-6.htm
RI-003. R.I. Gen. Laws 5-37.3-3, 5-37.3-4(a)(1)-(3)
Confidentiality of Health Care Communications and Information Act: a health care provider (any person licensed by the state, or lawfully providing health care) may not release confidential health care information without the patient's written consent on a compliant form, subject to listed exceptions.
Statute · Explicit · High · Applies regardless of HIPAA status to licensed providers.
https://webserver.rilegislature.gov/Statutes/TITLE5/5-37.3/INDEX.htm
RI-004. R.I. Gen. Laws 5-37.3-9
5-37.3 remedies: actual and exemplary (punitive) damages, costs and discretionary attorney's fees in a civil action; criminal fine up to $1,000 and/or up to 6 months' imprisonment for knowing and intentional violations.
Statute · Explicit · High · Strong private remedy relevant to review replies (application inferred). Washburn v. Rite Aid, 695 A.2d 495 (R.I. 1997) (subpoena did not authorize release) read via Justia (secondary).
https://webserver.rilegislature.gov/Statutes/TITLE5/5-37.3/5-37.3-9.htm
RI-008. R.I. Gen. Laws 9-1-28(a)
Statutory right against commercial use of name, portrait or picture without written consent: injunction and damages; treble damages for knowing use.
Statute · Explicit · High · Written consent required for patient photos/testimonials in ads (application inferred). 9-1-28.1 (general privacy rights) not read.
https://webserver.rilegislature.gov/Statutes/TITLE9/9-1/9-1-28.htm
RI-006. P.L. 2025 ch. 309; R.I. Gen. Laws 23-105-3 et seq.
Medical Spas Safety Act (P.L. 2025 ch. 309, S 0976 Sub A), R.I. Gen. Laws ch. 23-105, effective on passage (2025-06-30): med spas need a trained medical director (physician or CNP); initial assessment, written treatment plan, documented consent and records; non-physicians may perform only trained, delegated procedures; ablative lasers and energy devices limited to physicians, PAs and CNPs; RIDOH must adopt rules (including facility licensing) by 2026-07-01.
Statute · Explicit · High · No implementing rule located on the RI SOS rules site as of 2026-10-22 (search); statutory duties apply now (U-86).
https://webserver.rilegislature.gov/PublicLaws/law25/law25309.htm
RI-007. In re Mary Christina Simpson, M.D., Case Nos. C210784, C210788
Board of Medical Licensure and Discipline consent order: reprimand, ethics course (PROBE) and $2,200 administrative fee for a physician who intentionally viewed a non-patient's EHR without authorization (privileges previously suspended 30 days by the hospital), together with deficient Botox records; grounds cited: 5-37-5.1(21) and (24) and the physician licensure rule on medical records.
Enforcement (licensing; consent order) · Explicit (scanned order read as images) · High · E2. 5-37-5.1 has no explicit confidentiality item; the Board used the hospital-action and rule-violation grounds.
F-007. 45 CFR 164.502(a)
Covered entities may not use or disclose PHI except as permitted or required by the Privacy Rule.
Regulation · Explicit · High · No Privacy Rule exception permits disclosing PHI to rebut an online review; OCR's review cases cite 164.502(a).
https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502
F-024. HHS OCR resolution agreements
OCR has resolved at least four review-response matters against dental/medical practices: Elite Dental ($10,000, 2019), UPI/Igbinadolor ($50,000 CMP, 2022), New Vision Dental ($23,000, 2022), Manasa Health Center ($30,000, 2023).
Enforcement (resolution agreements / CMP) · Explicit · High · Resolution agreements include no admission of liability; UPI was a CMP after failure to respond (not a litigated judicial finding).
https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/index.html
F-003. 45 CFR 160.103
PHI covers individually identifiable health information in any form or medium held by a covered entity or business associate; excludes FERPA and employment records and persons deceased >50 years.
Regulation · Explicit · High
https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103