§ 23-6-18 Protection of records. – (a) Providers of health care, public health officials, and any other person who maintains records containing information on HIV test results of individuals are responsible for maintaining full confidentiality of these data, as provided in § 23-6-17, and shall take appropriate steps for their protection, including:
(1) Keeping records secure at all times and establishing adequate confidentiality safeguards for any records electronically stored;
(2) Establishing and enforcing reasonable rules limiting access to these records; and
(3) Training persons who handle records in security objectives and technique.
(b) The department shall evaluate reports of HIV/AIDS for completeness and potential referrals for service. All case reports shall be kept in a confidential and secure setting. An HIV/AIDS policy and protocol for security shall be developed and implemented by the department for this purpose.
(1) The department shall evaluate its procedures for HIV/AIDS reporting on a continuous basis for timeliness, completeness of reporting, and security of confidential information.
(2) The department's protocol shall be in accordance with the recommendations of the December 10, 1999 Morbidity and Mortality Weekly Report Recommendations and Reports, "CDC Guidelines for National Human Immunodeficiency Virus Case Surveillance, including monitoring for Human Immunodeficiency Virus infection and Acquired Immunodeficiency Syndrome" document, or its successor document, that pertains to patient records and confidentiality; provided, however, that in no event shall the protocol be less protective than that required by state law.
(3) All reports and notifications made pursuant to this section shall be confidential and protected from release except under the provisions of this law. Any person aggrieved by a violation of this section shall have a right of action in the superior court and may recover for each violation:
(i) Against any person who negligently violates a provision of this section, damages of one thousand dollars ($1,000) or actual damages, whichever is greater.
(ii) Against any person who intentionally or recklessly violates a provision of this section, damages of five thousand dollars ($5,000) or actual damages, whichever is greater.
(iii) Reasonable attorneys' fees;
(iv) Such other relief, including an injunction, as the court may deem appropriate; and
(v) Any action under this section is barred unless the action is commenced within three (3) years after the cause of action accrues. A cause of action shall accrue when the injured party becomes aware of an unauthorized disclosure.