§ 23-6-17 Confidentiality. – (a) It is unlawful for any person to disclose to a third party the results of an individual's HIV test without the prior written consent of that individual, or in the case of a minor, the minor's parent, guardian, or agent, on a form that specifically states that HIV test results may be released, except:
(1) A licensed laboratory or other health care facility which performs HIV tests shall report test results to a patient's licensed physician or other medical personnel who requested the test, and to the director of the department of health, pursuant to rules and regulations adopted for that purpose.
(2) A physician:
(i) May enter HIV test results in the medical record, as would be the case with any other diagnostic test;
(ii) May notify other health professionals directly involved in the care of the individual testing positive on the HIV test, or to whom that individual is referred for treatment;
(iii) May notify persons exposed to blood or other body fluids of an individual who tests positive for HIV, pursuant to § 23-6-14(4) through (8) (exceptions) and § 23-17-31 (testing of hospitalized patients);
(iv) May notify the director of the department of children, youth, and families, pursuant to § 23-6-14(3) (testing of a minor to secure services); and
(v) May inform third parties with whom an HIV-infected patient is in close and continuous exposure related contact, including but not limited to a spouse and/or partner, if the nature of the contact, in the physician's opinion, poses a clear and present danger of HIV transmission to the third party, and if the physician has reason to believe that the patient, despite the physician's strong encouragement, has not and will not inform the third party that they may have been exposed to HIV;
(3) As permitted in subsections (b)(1), (2), (5), (6), (8), (9), (10), (11), (12), (13), (14), and (15) of § 5-37.3-4 (confidentiality of health care information) and § 40.1-5-26 (disclosure of confidential information under mental health law), or as otherwise required by law.
(4) By a health care provider to appropriate persons entitled to receive notification of persons with infectious or communicable diseases pursuant to §§ 23-5-9 (report of infectious disease upon death) and 23-28.36-3 (notification to EMT, firefighter, police officer of infectious disease).
(b) Facilities and other health care providers subject to this section will have documentation that each person with access to any confidential information understands and acknowledges that the information may not be disclosed except as provided herein. The director shall establish protocols for collecting, maintaining and transferring the information (and ultimately destroying the information) to ensure the integrity of the transfer, and, if possible, the director may suspend any transfer, even to CDC, if he or she is not confident that the transfer is secure.